{ "generated_at": "2026-09-11T13:24:25.506236+00:00", "scanners": [ "claude-opus-5-cc-agentic-v1", "claude-sonnet-5-cc-agentic-v1", "deepseek-v4-flash-agentic-v1", "deepseek-v4-pro-agentic-v1", "deepseek-v4.1-flash-agentic-v1", "gemini-3.5-flash-agentic-v1", "gemma4-31b-agentic-v1", "glm-5-agentic-v1", "glm-5.1-agentic-v1", "glm-5.2-agentic-v1", "glm-5.3-agentic-v1", "gpt-5.5-agentic-v1", "gpt-5.6-luna-codex-cli", "gpt-5.6-sol-codex-cli", "gpt-5.6-terra-codex-cli", "gpt-6-astra-codex-cli", "gpt-daybreak-blue-codex-cli", "kimi-k2.5-agentic-v1", "kimi-k2.6-agentic-v1", "kimi-k2.7-agentic-v1", "kimi-k3-agentic-v1", "kolega-ca-cc-sonnet", "kolega-claude-adaptation", "kolega-claude-adaptation-deepseek-only", "kolega-claude-adaptation-v1", "kolega-devsec-core-v0.0.1", "kolega-devsec-max-v0.1.0", "kolega-original-claude-adaptation-deepseek-v4-pro", "kolega-v0.0.2-raw", "minimax-m2.7-agentic-v1", "ornith-q3-agentic-v1", "qwen3.6-35b-agentic-v1", "rowan", "semgrep", "sonarqube" ], "repos": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvna", "realvuln-dvpwa", "realvuln-dvws-node", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-lets-be-bad-guys", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-api", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnerable-tornado-app", "realvuln-vulnnodeapp", "realvuln-vulnpy", "realvuln-vulpy", "realvuln-xvna", "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ], "grid": { "realvuln-damn-vulnerable-flask-application": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 5, "fp": 11, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3125, "recall": 0.3571, "f1": 0.3333, "f2": 0.3472, "f2_score": 34.7, "f3": 0.3521, "f3_score": 35.2, "tpr": 0.3571, "fpr": 0.6875, "youden_j": -0.3304, "cvss_coverage": 1.0, "cvss_tp_weight": 39.7, "cvss_fp_weight": 64.1, "cvss_fn_weight": 71.0, "cvss_precision": 0.3825, "cvss_recall": 0.3586, "cvss_f3": 0.3609, "cvss_f3_score": 36.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 0, "fp": 10, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6667, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 58.3, "cvss_fn_weight": 110.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 8, "fp": 6, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5978, "recall": 0.5953, "f1": 0.5951, "f2": 0.5948, "f2_score": 59.5, "f3": 0.595, "f3_score": 59.5, "tpr": 0.5953, "fpr": 0.5606, "youden_j": 0.0346, "cvss_coverage": 1.0, "cvss_tp_weight": 63.6, "cvss_fp_weight": 25.9, "cvss_fn_weight": 47.1, "cvss_precision": 0.7152, "cvss_recall": 0.5748, "cvss_f3": 0.5861, "cvss_f3_score": 58.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-261" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 4, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6762, "recall": 0.5476, "f1": 0.6033, "f2": 0.5683, "f2_score": 56.8, "f3": 0.5577, "f3_score": 55.8, "tpr": 0.5476, "fpr": 0.4762, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 57.8, "cvss_fp_weight": 19.6, "cvss_fn_weight": 52.9, "cvss_precision": 0.7502, "cvss_recall": 0.5218, "cvss_f3": 0.5374, "cvss_f3_score": 53.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 3, "fp": 8, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2727, "recall": 0.2143, "f1": 0.24, "f2": 0.2239, "f2_score": 22.4, "f3": 0.219, "f3_score": 21.9, "tpr": 0.2143, "fpr": 0.6154, "youden_j": -0.4011, "cvss_coverage": 1.0, "cvss_tp_weight": 17.3, "cvss_fp_weight": 46.6, "cvss_fn_weight": 93.4, "cvss_precision": 0.2707, "cvss_recall": 0.1563, "cvss_f3": 0.1632, "cvss_f3_score": 16.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 1, "fp": 1, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.0952, "f1": 0.1333, "f2": 0.1075, "f2_score": 10.8, "f3": 0.101, "f3_score": 10.1, "tpr": 0.0952, "fpr": 0.2222, "youden_j": -0.127, "cvss_coverage": 1.0, "cvss_tp_weight": 12.1, "cvss_fp_weight": 7.8, "cvss_fn_weight": 98.6, "cvss_precision": 0.2522, "cvss_recall": 0.109, "cvss_f3": 0.1156, "cvss_f3_score": 11.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/views.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 6, "fp": 1, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.4286, "f1": 0.5714, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4511, "f3_score": 45.1, "tpr": 0.4286, "fpr": 0.2, "youden_j": 0.2286, "cvss_coverage": 1.0, "cvss_tp_weight": 49.4, "cvss_fp_weight": 5.8, "cvss_fn_weight": 61.3, "cvss_precision": 0.8945, "cvss_recall": 0.4463, "cvss_f3": 0.4698, "cvss_f3_score": 47.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 9, "fp": 4, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6838, "recall": 0.6667, "f1": 0.6744, "f2": 0.6695, "f2_score": 66.9, "f3": 0.6681, "f3_score": 66.8, "tpr": 0.6667, "fpr": 0.5185, "youden_j": 0.1482, "cvss_coverage": 1.0, "cvss_tp_weight": 78.5, "cvss_fp_weight": 23.5, "cvss_fn_weight": 32.2, "cvss_precision": 0.7698, "cvss_recall": 0.7095, "cvss_f3": 0.715, "cvss_f3_score": 71.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 13, "fp": 4, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.748, "recall": 0.9048, "f1": 0.8185, "f2": 0.868, "f2_score": 86.8, "f3": 0.886, "f3_score": 88.6, "tpr": 0.9048, "fpr": 0.5095, "youden_j": 0.3952, "cvss_coverage": 1.0, "cvss_tp_weight": 99.8, "cvss_fp_weight": 21.7, "cvss_fn_weight": 10.9, "cvss_precision": 0.8227, "cvss_recall": 0.9013, "cvss_f3": 0.8926, "cvss_f3_score": 89.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 10, "fp": 2, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8415, "recall": 0.7381, "f1": 0.7852, "f2": 0.756, "f2_score": 75.6, "f3": 0.7469, "f3_score": 74.7, "tpr": 0.7381, "fpr": 0.3206, "youden_j": 0.4175, "cvss_coverage": 1.0, "cvss_tp_weight": 87.1, "cvss_fp_weight": 9.9, "cvss_fn_weight": 23.6, "cvss_precision": 0.8993, "cvss_recall": 0.7868, "cvss_f3": 0.7967, "cvss_f3_score": 79.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 4, "fp": 9, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.2857, "f1": 0.2963, "f2": 0.2899, "f2_score": 29.0, "f3": 0.2878, "f3_score": 28.8, "tpr": 0.2857, "fpr": 0.6429, "youden_j": -0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 27.1, "cvss_fp_weight": 52.4, "cvss_fn_weight": 83.6, "cvss_precision": 0.3407, "cvss_recall": 0.2448, "cvss_f3": 0.2519, "cvss_f3_score": 25.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 7, "fp": 1, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8413, "recall": 0.5, "f1": 0.6253, "f2": 0.5434, "f2_score": 54.3, "f3": 0.5207, "f3_score": 52.1, "tpr": 0.5, "fpr": 0.2175, "youden_j": 0.2825, "cvss_coverage": 1.0, "cvss_tp_weight": 54.3, "cvss_fp_weight": 7.8, "cvss_fn_weight": 56.4, "cvss_precision": 0.8748, "cvss_recall": 0.4902, "cvss_f3": 0.5126, "cvss_f3_score": 51.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 5, "fp": 7, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.3571, "f1": 0.3846, "f2": 0.3676, "f2_score": 36.8, "f3": 0.3623, "f3_score": 36.2, "tpr": 0.3571, "fpr": 0.5833, "youden_j": -0.2262, "cvss_coverage": 1.0, "cvss_tp_weight": 42.0, "cvss_fp_weight": 35.5, "cvss_fn_weight": 68.7, "cvss_precision": 0.5422, "cvss_recall": 0.3794, "cvss_f3": 0.3911, "cvss_f3_score": 39.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 7, "fp": 7, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5, "f1": 0.5, "f2": 0.5, "f2_score": 50.0, "f3": 0.5, "f3_score": 50.0, "tpr": 0.5, "fpr": 0.5833, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 51.9, "cvss_fp_weight": 35.5, "cvss_fn_weight": 58.8, "cvss_precision": 0.5941, "cvss_recall": 0.4688, "cvss_f3": 0.4789, "cvss_f3_score": 47.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 3, "fp": 6, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.2143, "f1": 0.2609, "f2": 0.2308, "f2_score": 23.1, "f3": 0.2222, "f3_score": 22.2, "tpr": 0.2143, "fpr": 0.5455, "youden_j": -0.3312, "cvss_coverage": 1.0, "cvss_tp_weight": 21.0, "cvss_fp_weight": 29.6, "cvss_fn_weight": 89.7, "cvss_precision": 0.4148, "cvss_recall": 0.1897, "cvss_f3": 0.2006, "cvss_f3_score": 20.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 4, "fp": 8, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.2857, "f1": 0.3077, "f2": 0.2941, "f2_score": 29.4, "f3": 0.2899, "f3_score": 29.0, "tpr": 0.2857, "fpr": 0.6154, "youden_j": -0.3297, "cvss_coverage": 1.0, "cvss_tp_weight": 27.1, "cvss_fp_weight": 46.6, "cvss_fn_weight": 83.6, "cvss_precision": 0.3677, "cvss_recall": 0.2448, "cvss_f3": 0.2533, "cvss_f3_score": 25.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 7, "fp": 9, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.5, "f1": 0.4667, "f2": 0.4861, "f2_score": 48.6, "f3": 0.493, "f3_score": 49.3, "tpr": 0.5, "fpr": 0.6429, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 51.9, "cvss_fp_weight": 41.8, "cvss_fn_weight": 58.8, "cvss_precision": 0.554, "cvss_recall": 0.4688, "cvss_f3": 0.4762, "cvss_f3_score": 47.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 7, "fp": 8, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5307, "recall": 0.5238, "f1": 0.5025, "f2": 0.5081, "f2_score": 50.8, "f3": 0.5145, "f3_score": 51.4, "tpr": 0.5238, "fpr": 0.6111, "youden_j": -0.0873, "cvss_coverage": 1.0, "cvss_tp_weight": 59.0, "cvss_fp_weight": 41.1, "cvss_fn_weight": 51.7, "cvss_precision": 0.6286, "cvss_recall": 0.533, "cvss_f3": 0.5324, "cvss_f3_score": 53.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 9, "fp": 5, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6505, "recall": 0.6191, "f1": 0.6027, "f2": 0.6047, "f2_score": 60.5, "f3": 0.6104, "f3_score": 61.0, "tpr": 0.6191, "fpr": 0.5159, "youden_j": 0.1032, "cvss_coverage": 1.0, "cvss_tp_weight": 68.0, "cvss_fp_weight": 31.1, "cvss_fn_weight": 42.7, "cvss_precision": 0.7117, "cvss_recall": 0.6146, "cvss_f3": 0.6121, "cvss_f3_score": 61.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 9, "fp": 5, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6462, "recall": 0.619, "f1": 0.6308, "f2": 0.6233, "f2_score": 62.3, "f3": 0.6211, "f3_score": 62.1, "tpr": 0.619, "fpr": 0.5333, "youden_j": 0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 68.4, "cvss_fp_weight": 23.6, "cvss_fn_weight": 42.3, "cvss_precision": 0.7371, "cvss_recall": 0.6176, "cvss_f3": 0.6265, "cvss_f3_score": 62.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 6, "fp": 6, "fn": 8, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4286, "f1": 0.4615, "f2": 0.4412, "f2_score": 44.1, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4286, "fpr": 0.5455, "youden_j": -0.1169, "cvss_coverage": 1.0, "cvss_tp_weight": 45.8, "cvss_fp_weight": 35.0, "cvss_fn_weight": 64.9, "cvss_precision": 0.5671, "cvss_recall": 0.4137, "cvss_f3": 0.4252, "cvss_f3_score": 42.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 10, "fp": 4, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.5, "youden_j": 0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 31.0, "cvss_fn_weight": 28.1, "cvss_precision": 0.7271, "cvss_recall": 0.7462, "cvss_f3": 0.7442, "cvss_f3_score": 74.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 13, "fp": 28, "fn": 1, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3171, "recall": 0.9286, "f1": 0.4727, "f2": 0.6701, "f2_score": 67.0, "f3": 0.7784, "f3_score": 77.8, "tpr": 0.9286, "fpr": 0.8485, "youden_j": 0.0801, "cvss_coverage": 1.0, "cvss_tp_weight": 104.6, "cvss_fp_weight": 170.5, "cvss_fn_weight": 6.1, "cvss_precision": 0.3802, "cvss_recall": 0.9449, "cvss_f3": 0.8227, "cvss_f3_score": 82.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "test.db", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/error.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 12, "fp": 19, "fn": 2, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3871, "recall": 0.8571, "f1": 0.5333, "f2": 0.6897, "f2_score": 69.0, "f3": 0.7643, "f3_score": 76.4, "tpr": 0.8571, "fpr": 0.7917, "youden_j": 0.0655, "cvss_coverage": 1.0, "cvss_tp_weight": 94.8, "cvss_fp_weight": 122.0, "cvss_fn_weight": 15.9, "cvss_precision": 0.4373, "cvss_recall": 0.8564, "cvss_f3": 0.7815, "cvss_f3_score": 78.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "gitignore", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 0, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2143, "f1": 0.3529, "f2": 0.2542, "f2_score": 25.4, "f3": 0.2326, "f3_score": 23.3, "tpr": 0.2143, "fpr": 0.0, "youden_j": 0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 24.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 86.7, "cvss_precision": 1.0, "cvss_recall": 0.2168, "cvss_f3": 0.2352, "cvss_f3_score": 23.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 14, "fp": 34, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2917, "recall": 1.0, "f1": 0.4516, "f2": 0.6731, "f2_score": 67.3, "f3": 0.8046, "f3_score": 80.5, "tpr": 1.0, "fpr": 0.9189, "youden_j": 0.0811, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 258.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2998, "cvss_recall": 1.0, "cvss_f3": 0.8107, "cvss_f3_score": 81.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py:108-109, templates/error.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py:109, templates/error.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/error.html", "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 14, "fp": 3, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 1.0, "f1": 0.9032, "f2": 0.9589, "f2_score": 95.9, "f3": 0.979, "f3_score": 97.9, "tpr": 1.0, "fpr": 0.4286, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 19.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.8535, "cvss_recall": 1.0, "cvss_f3": 0.9831, "cvss_f3_score": 98.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 3, "fp": 12, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.2143, "f1": 0.2069, "f2": 0.2113, "f2_score": 21.1, "f3": 0.2128, "f3_score": 21.3, "tpr": 0.2143, "fpr": 0.7059, "youden_j": -0.4916, "cvss_coverage": 1.0, "cvss_tp_weight": 20.3, "cvss_fp_weight": 75.0, "cvss_fn_weight": 90.4, "cvss_precision": 0.213, "cvss_recall": 0.1834, "cvss_f3": 0.186, "cvss_f3_score": 18.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 14, "fp": 35, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 1.0, "f1": 0.4444, "f2": 0.6667, "f2_score": 66.7, "f3": 0.8, "f3_score": 80.0, "tpr": 1.0, "fpr": 0.9211, "youden_j": 0.0789, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 264.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.2954, "cvss_recall": 1.0, "cvss_f3": 0.8074, "cvss_f3_score": 80.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py:108-109, templates/error.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py:109, templates/error.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/error.html", "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 4, "fp": 3, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5853, "recall": 0.2857, "f1": 0.383, "f2": 0.3179, "f2_score": 31.8, "f3": 0.3009, "f3_score": 30.1, "tpr": 0.2857, "fpr": 0.4305, "youden_j": -0.1448, "cvss_coverage": 1.0, "cvss_tp_weight": 34.4, "cvss_fp_weight": 17.5, "cvss_fn_weight": 76.3, "cvss_precision": 0.669, "cvss_recall": 0.3108, "cvss_f3": 0.3283, "cvss_f3_score": 32.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 1, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 1, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": "templates/error.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 6, "fp": 2, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4286, "f1": 0.5455, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4478, "f3_score": 44.8, "tpr": 0.4286, "fpr": 0.3333, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 45.7, "cvss_fp_weight": 11.7, "cvss_fn_weight": 65.0, "cvss_precision": 0.7968, "cvss_recall": 0.4128, "cvss_f3": 0.4337, "cvss_f3_score": 43.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": "app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 4, "fp": 9, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.2857, "f1": 0.2963, "f2": 0.2899, "f2_score": 29.0, "f3": 0.2878, "f3_score": 28.8, "tpr": 0.2857, "fpr": 0.6923, "youden_j": -0.4066, "cvss_coverage": 1.0, "cvss_tp_weight": 32.5, "cvss_fp_weight": 41.8, "cvss_fn_weight": 78.2, "cvss_precision": 0.4375, "cvss_recall": 0.2936, "cvss_f3": 0.3036, "cvss_f3_score": 30.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-829" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "rowan": { "scanner": "rowan", "tp": 3, "fp": 6, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.2143, "f1": 0.2609, "f2": 0.2308, "f2_score": 23.1, "f3": 0.2222, "f3_score": 22.2, "tpr": 0.2143, "fpr": 0.5455, "youden_j": -0.3312, "cvss_coverage": 1.0, "cvss_tp_weight": 27.1, "cvss_fp_weight": 18.0, "cvss_fn_weight": 83.6, "cvss_precision": 0.6009, "cvss_recall": 0.2448, "cvss_f3": 0.2602, "cvss_f3_score": 26.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": "app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 16, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.3571, "f1": 0.2857, "f2": 0.3247, "f2_score": 32.5, "f3": 0.3401, "f3_score": 34.0, "tpr": 0.3571, "fpr": 0.7619, "youden_j": -0.4048, "cvss_coverage": 1.0, "cvss_tp_weight": 34.2, "cvss_fp_weight": 93.2, "cvss_fn_weight": 76.5, "cvss_precision": 0.2684, "cvss_recall": 0.3089, "cvss_f3": 0.3043, "cvss_f3_score": 30.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/register.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/register.html", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 110.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-003", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-010", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "damn-vulnerable-flask-app-015", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "damn-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-798" } ] } }, "realvuln-damn-vulnerable-graphql-application": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 24, "fp": 17, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5854, "recall": 0.6667, "f1": 0.6234, "f2": 0.6486, "f2_score": 64.9, "f3": 0.6575, "f3_score": 65.8, "tpr": 0.6667, "fpr": 0.8095, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 179.6, "cvss_fp_weight": 91.1, "cvss_fn_weight": 63.8, "cvss_precision": 0.6633, "cvss_recall": 0.7379, "cvss_f3": 0.7297, "cvss_f3_score": 73.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 13, "fp": 7, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.3611, "f1": 0.4643, "f2": 0.3963, "f2_score": 39.6, "f3": 0.3779, "f3_score": 37.8, "tpr": 0.3611, "fpr": 0.6364, "youden_j": -0.2753, "cvss_coverage": 1.0, "cvss_tp_weight": 105.0, "cvss_fp_weight": 48.0, "cvss_fn_weight": 138.4, "cvss_precision": 0.6863, "cvss_recall": 0.4314, "cvss_f3": 0.448, "cvss_f3_score": 44.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 6, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7093, "recall": 0.4028, "f1": 0.5131, "f2": 0.4406, "f2_score": 44.0, "f3": 0.4209, "f3_score": 42.1, "tpr": 0.4028, "fpr": 0.596, "youden_j": -0.1932, "cvss_coverage": 1.0, "cvss_tp_weight": 115.5, "cvss_fp_weight": 31.6, "cvss_fn_weight": 127.8, "cvss_precision": 0.7852, "cvss_recall": 0.4748, "cvss_f3": 0.4942, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 4, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7629, "recall": 0.3796, "f1": 0.5067, "f2": 0.4219, "f2_score": 42.2, "f3": 0.3997, "f3_score": 40.0, "tpr": 0.3796, "fpr": 0.4963, "youden_j": -0.1167, "cvss_coverage": 1.0, "cvss_tp_weight": 109.5, "cvss_fp_weight": 29.7, "cvss_fn_weight": 133.9, "cvss_precision": 0.789, "cvss_recall": 0.4497, "cvss_f3": 0.4699, "cvss_f3_score": 47.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 22, "fp": 32, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4074, "recall": 0.6111, "f1": 0.4889, "f2": 0.5556, "f2_score": 55.6, "f3": 0.582, "f3_score": 58.2, "tpr": 0.6111, "fpr": 0.8889, "youden_j": -0.2778, "cvss_coverage": 1.0, "cvss_tp_weight": 161.5, "cvss_fp_weight": 219.4, "cvss_fn_weight": 81.9, "cvss_precision": 0.424, "cvss_recall": 0.6635, "cvss_f3": 0.628, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-183" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 13, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6869, "recall": 0.3889, "f1": 0.447, "f2": 0.4018, "f2_score": 40.2, "f3": 0.3939, "f3_score": 39.4, "tpr": 0.3889, "fpr": 0.5204, "youden_j": -0.1316, "cvss_coverage": 1.0, "cvss_tp_weight": 109.6, "cvss_fp_weight": 86.9, "cvss_fn_weight": 133.8, "cvss_precision": 0.7081, "cvss_recall": 0.4501, "cvss_f3": 0.4539, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 16, "recall": 0.0588 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 9, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.25, "f1": 0.4, "f2": 0.2941, "f2_score": 29.4, "f3": 0.2703, "f3_score": 27.0, "tpr": 0.25, "fpr": 0.0, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 75.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 167.8, "cvss_precision": 1.0, "cvss_recall": 0.3106, "cvss_f3": 0.3336, "cvss_f3_score": 33.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 8, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6083, "recall": 0.3611, "f1": 0.4524, "f2": 0.3927, "f2_score": 39.2, "f3": 0.3762, "f3_score": 37.6, "tpr": 0.3611, "fpr": 0.6737, "youden_j": -0.3126, "cvss_coverage": 1.0, "cvss_tp_weight": 105.7, "cvss_fp_weight": 52.9, "cvss_fn_weight": 137.7, "cvss_precision": 0.6643, "cvss_recall": 0.4344, "cvss_f3": 0.4499, "cvss_f3_score": 45.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 17, "fp": 16, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5228, "recall": 0.4722, "f1": 0.4937, "f2": 0.48, "f2_score": 48.0, "f3": 0.476, "f3_score": 47.6, "tpr": 0.4722, "fpr": 0.7919, "youden_j": -0.3197, "cvss_coverage": 1.0, "cvss_tp_weight": 132.7, "cvss_fp_weight": 99.1, "cvss_fn_weight": 110.7, "cvss_precision": 0.5778, "cvss_recall": 0.5453, "cvss_f3": 0.5477, "cvss_f3_score": 54.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 17, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5012, "recall": 0.4537, "f1": 0.4744, "f2": 0.4614, "f2_score": 46.1, "f3": 0.4574, "f3_score": 45.8, "tpr": 0.4537, "fpr": 0.7998, "youden_j": -0.3462, "cvss_coverage": 1.0, "cvss_tp_weight": 127.8, "cvss_fp_weight": 107.9, "cvss_fn_weight": 115.6, "cvss_precision": 0.5479, "cvss_recall": 0.5251, "cvss_f3": 0.5266, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-019", "file": "core/models.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 25, "fp": 30, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.6944, "f1": 0.5495, "f2": 0.6281, "f2_score": 62.8, "f3": 0.6596, "f3_score": 66.0, "tpr": 0.6944, "fpr": 0.8824, "youden_j": -0.1879, "cvss_coverage": 1.0, "cvss_tp_weight": 177.4, "cvss_fp_weight": 193.0, "cvss_fn_weight": 66.0, "cvss_precision": 0.4789, "cvss_recall": 0.7288, "cvss_f3": 0.6927, "cvss_f3_score": 69.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-138" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-033", "file": "core/views.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 20, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8275, "recall": 0.5648, "f1": 0.6698, "f2": 0.6023, "f2_score": 60.2, "f3": 0.5829, "f3_score": 58.3, "tpr": 0.5648, "fpr": 0.5095, "youden_j": 0.0553, "cvss_coverage": 1.0, "cvss_tp_weight": 157.8, "cvss_fp_weight": 25.5, "cvss_fn_weight": 85.6, "cvss_precision": 0.8616, "cvss_recall": 0.6483, "cvss_f3": 0.6646, "cvss_f3_score": 66.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 0, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3889, "f1": 0.56, "f2": 0.443, "f2_score": 44.3, "f3": 0.4142, "f3_score": 41.4, "tpr": 0.3889, "fpr": 0.0, "youden_j": 0.3889, "cvss_coverage": 1.0, "cvss_tp_weight": 114.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 129.3, "cvss_precision": 1.0, "cvss_recall": 0.4688, "cvss_f3": 0.4951, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 10, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7436, "recall": 0.8056, "f1": 0.7733, "f2": 0.7923, "f2_score": 79.2, "f3": 0.7989, "f3_score": 79.9, "tpr": 0.8056, "fpr": 0.7143, "youden_j": 0.0913, "cvss_coverage": 1.0, "cvss_tp_weight": 199.1, "cvss_fp_weight": 62.2, "cvss_fn_weight": 44.3, "cvss_precision": 0.7619, "cvss_recall": 0.818, "cvss_f3": 0.812, "cvss_f3_score": 81.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 4, "recall": 0.7647 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-033", "file": "core/views.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-018", "file": "core/views.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-029", "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvga-032", "file": "core/helpers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.3889, "f1": 0.5385, "f2": 0.4375, "f2_score": 43.8, "f3": 0.4118, "f3_score": 41.2, "tpr": 0.3889, "fpr": 0.3333, "youden_j": 0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 110.5, "cvss_fp_weight": 13.7, "cvss_fn_weight": 132.9, "cvss_precision": 0.8896, "cvss_recall": 0.454, "cvss_f3": 0.4774, "cvss_f3_score": 47.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 14, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.6667, "f1": 0.6486, "f2": 0.6593, "f2_score": 65.9, "f3": 0.663, "f3_score": 66.3, "tpr": 0.6667, "fpr": 0.7778, "youden_j": -0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 172.8, "cvss_fp_weight": 89.6, "cvss_fn_weight": 70.6, "cvss_precision": 0.6584, "cvss_recall": 0.7099, "cvss_f3": 0.7044, "cvss_f3_score": 70.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-033", "file": "core/views.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 10, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.7778, "f1": 0.7568, "f2": 0.7692, "f2_score": 76.9, "f3": 0.7735, "f3_score": 77.3, "tpr": 0.7778, "fpr": 0.7143, "youden_j": 0.0635, "cvss_coverage": 1.0, "cvss_tp_weight": 199.8, "cvss_fp_weight": 68.6, "cvss_fn_weight": 43.6, "cvss_precision": 0.7445, "cvss_recall": 0.8209, "cvss_f3": 0.8125, "cvss_f3_score": 81.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-033", "file": "core/views.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-032", "file": "core/helpers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-024", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 8, "fn": 23, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6249, "recall": 0.3518, "f1": 0.45, "f2": 0.3854, "f2_score": 38.6, "f3": 0.3679, "f3_score": 36.8, "tpr": 0.3518, "fpr": 0.695, "youden_j": -0.3431, "cvss_coverage": 1.0, "cvss_tp_weight": 103.0, "cvss_fp_weight": 48.4, "cvss_fn_weight": 140.4, "cvss_precision": 0.683, "cvss_recall": 0.4233, "cvss_f3": 0.44, "cvss_f3_score": 44.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 11, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5792, "recall": 0.4259, "f1": 0.4841, "f2": 0.4462, "f2_score": 44.6, "f3": 0.4357, "f3_score": 43.6, "tpr": 0.4259, "fpr": 0.727, "youden_j": -0.3011, "cvss_coverage": 1.0, "cvss_tp_weight": 120.2, "cvss_fp_weight": 67.1, "cvss_fn_weight": 123.2, "cvss_precision": 0.6471, "cvss_recall": 0.4937, "cvss_f3": 0.5038, "cvss_f3_score": 50.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 19, "fp": 25, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4512, "recall": 0.5278, "f1": 0.4788, "f2": 0.5048, "f2_score": 50.5, "f3": 0.5156, "f3_score": 51.6, "tpr": 0.5278, "fpr": 0.8446, "youden_j": -0.3168, "cvss_coverage": 1.0, "cvss_tp_weight": 143.7, "cvss_fp_weight": 158.9, "cvss_fn_weight": 99.7, "cvss_precision": 0.5096, "cvss_recall": 0.5905, "cvss_f3": 0.5765, "cvss_f3_score": 57.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 6, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.4444, "f1": 0.5517, "f2": 0.4819, "f2_score": 48.2, "f3": 0.4624, "f3_score": 46.2, "tpr": 0.4444, "fpr": 0.6, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 127.5, "cvss_fp_weight": 28.4, "cvss_fn_weight": 115.9, "cvss_precision": 0.8177, "cvss_recall": 0.5238, "cvss_f3": 0.5434, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 10, "fn": 24, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.3333, "f1": 0.4138, "f2": 0.3614, "f2_score": 36.1, "f3": 0.3468, "f3_score": 34.7, "tpr": 0.3333, "fpr": 0.7692, "youden_j": -0.4359, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 69.0, "cvss_fn_weight": 150.4, "cvss_precision": 0.5741, "cvss_recall": 0.3821, "cvss_f3": 0.3953, "cvss_f3_score": 39.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 7, "fp": 1, "fn": 7, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "dvga-fp-002", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 27, "fp": 40, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.403, "recall": 0.75, "f1": 0.5243, "f2": 0.6398, "f2_score": 64.0, "f3": 0.6905, "f3_score": 69.1, "tpr": 0.75, "fpr": 0.9091, "youden_j": -0.1591, "cvss_coverage": 1.0, "cvss_tp_weight": 189.5, "cvss_fp_weight": 317.5, "cvss_fn_weight": 53.9, "cvss_precision": 0.3738, "cvss_recall": 0.7786, "cvss_f3": 0.7025, "cvss_f3_score": 70.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-033", "file": "core/views.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-183" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/parser.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-029", "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 21, "fp": 21, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5833, "f1": 0.5385, "f2": 0.5645, "f2_score": 56.5, "f3": 0.5738, "f3_score": 57.4, "tpr": 0.5833, "fpr": 0.84, "youden_j": -0.2567, "cvss_coverage": 1.0, "cvss_tp_weight": 160.1, "cvss_fp_weight": 155.5, "cvss_fn_weight": 83.3, "cvss_precision": 0.5073, "cvss_recall": 0.6578, "cvss_f3": 0.6388, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-019", "file": "core/models.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-309" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 8, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.1111, "f1": 0.1667, "f2": 0.1282, "f2_score": 12.8, "f3": 0.119, "f3_score": 11.9, "tpr": 0.1111, "fpr": 0.6667, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 33.2, "cvss_fp_weight": 70.0, "cvss_fn_weight": 210.2, "cvss_precision": 0.3217, "cvss_recall": 0.1364, "cvss_f3": 0.1447, "cvss_f3_score": 14.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "high": { "tp": 2, "fp": 0, "fn": 12, "recall": 0.1429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 16, "recall": 0.0588 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_auth.py", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_mutations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_mutations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_queries.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvga-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 29, "fp": 78, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.271, "recall": 0.8056, "f1": 0.4056, "f2": 0.5777, "f2_score": 57.8, "f3": 0.6729, "f3_score": 67.3, "tpr": 0.8056, "fpr": 0.9512, "youden_j": -0.1457, "cvss_coverage": 1.0, "cvss_tp_weight": 205.1, "cvss_fp_weight": 579.0, "cvss_fn_weight": 38.3, "cvss_precision": 0.2616, "cvss_recall": 0.8426, "cvss_f3": 0.6895, "cvss_f3_score": 68.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 13, "fp": 0, "fn": 4, "recall": 0.7647 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvga-026", "file": "core/helpers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-184" }, { "classification": "TP", "ground_truth_id": "dvga-029", "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-024", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/audit.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 34, "fp": 16, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.68, "recall": 0.9444, "f1": 0.7907, "f2": 0.8763, "f2_score": 87.6, "f3": 0.9091, "f3_score": 90.9, "tpr": 0.9444, "fpr": 0.8, "youden_j": 0.1444, "cvss_coverage": 1.0, "cvss_tp_weight": 234.4, "cvss_fp_weight": 120.5, "cvss_fn_weight": 9.0, "cvss_precision": 0.6605, "cvss_recall": 0.963, "cvss_f3": 0.9208, "cvss_f3_score": 92.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-026", "file": "core/helpers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-032", "file": "core/helpers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-029", "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvga-019", "file": "core/models.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-018", "file": "core/views.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-024", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-1395" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-1395" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 25, "fp": 28, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4717, "recall": 0.6944, "f1": 0.5618, "f2": 0.6345, "f2_score": 63.5, "f3": 0.6631, "f3_score": 66.3, "tpr": 0.6944, "fpr": 0.875, "youden_j": -0.1806, "cvss_coverage": 1.0, "cvss_tp_weight": 183.3, "cvss_fp_weight": 210.0, "cvss_fn_weight": 60.1, "cvss_precision": 0.4661, "cvss_recall": 0.7531, "cvss_f3": 0.7094, "cvss_f3_score": 70.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "dvga-031", "file": "core/models.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-035", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 30, "fp": 88, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2542, "recall": 0.8333, "f1": 0.3896, "f2": 0.5725, "f2_score": 57.3, "f3": 0.6787, "f3_score": 67.9, "tpr": 0.8333, "fpr": 0.9565, "youden_j": -0.1232, "cvss_coverage": 1.0, "cvss_tp_weight": 210.4, "cvss_fp_weight": 635.5, "cvss_fn_weight": 33.0, "cvss_precision": 0.2487, "cvss_recall": 0.8644, "cvss_f3": 0.6929, "cvss_f3_score": 69.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 14, "fp": 0, "fn": 3, "recall": 0.8235 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvga-026", "file": "core/helpers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-184" }, { "classification": "TP", "ground_truth_id": "dvga-029", "file": "core/middleware.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/middleware.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-027", "file": "core/middleware.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvga-020", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvga-019", "file": "core/models.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-028", "file": "core/security.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "TP", "ground_truth_id": "dvga-025", "file": "core/security.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvga-030", "file": "core/security.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-034", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvga-036", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-017", "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvga-021", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-012", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvga-022", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvga-023", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvga-024", "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-015", "file": "setup.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/audit.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dvga-009", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-008", "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 7, "fp": 5, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7728, "recall": 0.1944, "f1": 0.2596, "f2": 0.215, "f2_score": 21.4, "f3": 0.2041, "f3_score": 20.4, "tpr": 0.1944, "fpr": 0.3572, "youden_j": -0.1627, "cvss_coverage": 1.0, "cvss_tp_weight": 56.6, "cvss_fp_weight": 34.3, "cvss_fn_weight": 186.8, "cvss_precision": 0.7915, "cvss_recall": 0.2326, "cvss_f3": 0.2428, "cvss_f3_score": 24.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvga-002", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-004", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-005", "file": "core/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/helpers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvga-010", "file": "core/helpers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvga-003", "file": "core/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvga-006", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "setup.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "dvga-013", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-014", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvga-016", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-95" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": { "scanner": "rowan", "tp": 2, "fp": 45, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0426, "recall": 0.0556, "f1": 0.0482, "f2": 0.0524, "f2_score": 5.2, "f3": 0.0539, "f3_score": 5.4, "tpr": 0.0556, "fpr": 0.9184, "youden_j": -0.8628, "cvss_coverage": 1.0, "cvss_tp_weight": 14.4, "cvss_fp_weight": 110.5, "cvss_fn_weight": 229.0, "cvss_precision": 0.1153, "cvss_recall": 0.0592, "cvss_f3": 0.0622, "cvss_f3_score": 6.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 16, "recall": 0.0588 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "static/bootstrap/js/bootstrap.bundle.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/bootstrap/js/bootstrap.bundle.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/bootstrap/js/bootstrap.bundle.min.js", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "static/bootstrap/js/bootstrap.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/bootstrap/js/bootstrap.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/common.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/common.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_graphiql.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_graphiql.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_graphql.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_graphql.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/graphql.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.min.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/security.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "dvga-011", "file": "core/view_override.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/view_override.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.min.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/jquery.slim.min.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvga-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 7, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.0556, "f1": 0.0889, "f2": 0.0654, "f2_score": 6.5, "f3": 0.0601, "f3_score": 6.0, "tpr": 0.0556, "fpr": 0.6364, "youden_j": -0.5808, "cvss_coverage": 1.0, "cvss_tp_weight": 16.6, "cvss_fp_weight": 48.0, "cvss_fn_weight": 226.8, "cvss_precision": 0.257, "cvss_recall": 0.0682, "cvss_f3": 0.0736, "cvss_f3_score": 7.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "high": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvga-007", "file": "core/helpers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvga-001", "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/graphql.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/graphql.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "static/jquery/graphql.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/partials/solutions/solution_11.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/paste.html", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvga-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 36, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 243.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dvga-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvga-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvga-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvga-007", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "dvga-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvga-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvga-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvga-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvga-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvga-018", "file": null, "cwe": "CWE-674" }, { "classification": "FN", "ground_truth_id": "dvga-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvga-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvga-021", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvga-022", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvga-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvga-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvga-028", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvga-029", "file": null, "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "dvga-030", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvga-031", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvga-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvga-033", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dvga-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvga-035", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "dvga-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvga-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvga-fp-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvga-036", "file": null, "cwe": "CWE-200" } ] } }, "realvuln-djangoat": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 27, "fp": 24, "fn": 25, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5294, "recall": 0.5192, "f1": 0.5243, "f2": 0.5212, "f2_score": 52.1, "f3": 0.5202, "f3_score": 52.0, "tpr": 0.5192, "fpr": 0.8, "youden_j": -0.2808, "cvss_coverage": 1.0, "cvss_tp_weight": 197.7, "cvss_fp_weight": 157.0, "cvss_fn_weight": 157.6, "cvss_precision": 0.5574, "cvss_recall": 0.5564, "cvss_f3": 0.5565, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 13, "fp": 0, "fn": 7, "recall": 0.65 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/nav_loggedin.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-015", "file": "template/users/work_info/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 15, "fn": 35, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5312, "recall": 0.3269, "f1": 0.4048, "f2": 0.3542, "f2_score": 35.4, "f3": 0.34, "f3_score": 34.0, "tpr": 0.3269, "fpr": 0.7143, "youden_j": -0.3874, "cvss_coverage": 1.0, "cvss_tp_weight": 136.3, "cvss_fp_weight": 89.4, "cvss_fn_weight": 219.0, "cvss_precision": 0.6038, "cvss_recall": 0.3836, "cvss_f3": 0.3981, "cvss_f3_score": 39.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 20, "recall": 0.1304 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 8, "fn": 39, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6033, "recall": 0.2436, "f1": 0.347, "f2": 0.2765, "f2_score": 27.7, "f3": 0.259, "f3_score": 25.9, "tpr": 0.2436, "fpr": 0.575, "youden_j": -0.3314, "cvss_coverage": 1.0, "cvss_tp_weight": 101.4, "cvss_fp_weight": 46.2, "cvss_fn_weight": 253.9, "cvss_precision": 0.6894, "cvss_recall": 0.2853, "cvss_f3": 0.3031, "cvss_f3_score": 30.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 3, "fp": 0, "fn": 17, "recall": 0.15 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 21, "recall": 0.087 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Message/message.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 9, "fn": 37, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.633, "recall": 0.2885, "f1": 0.3958, "f2": 0.3235, "f2_score": 32.4, "f3": 0.305, "f3_score": 30.5, "tpr": 0.2885, "fpr": 0.5893, "youden_j": -0.3008, "cvss_coverage": 1.0, "cvss_tp_weight": 121.3, "cvss_fp_weight": 50.5, "cvss_fn_weight": 234.0, "cvss_precision": 0.7023, "cvss_recall": 0.3415, "cvss_f3": 0.3599, "cvss_f3_score": 36.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 7, "fp": 0, "fn": 13, "recall": 0.35 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 21, "recall": 0.087 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-013", "file": "app/views/users/work_info/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 9, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.4615, "f1": 0.5647, "f2": 0.4979, "f2_score": 49.8, "f3": 0.479, "f3_score": 47.9, "tpr": 0.4615, "fpr": 0.6, "youden_j": -0.1385, "cvss_coverage": 1.0, "cvss_tp_weight": 181.7, "cvss_fp_weight": 54.9, "cvss_fn_weight": 173.6, "cvss_precision": 0.7679, "cvss_recall": 0.5114, "cvss_f3": 0.5291, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 1, "fn": 43, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.1731, "f1": 0.2903, "f2": 0.2064, "f2_score": 20.6, "f3": 0.1883, "f3_score": 18.8, "tpr": 0.1731, "fpr": 0.1429, "youden_j": 0.0302, "cvss_coverage": 1.0, "cvss_tp_weight": 68.1, "cvss_fp_weight": 6.8, "cvss_fn_weight": 287.2, "cvss_precision": 0.9092, "cvss_recall": 0.1917, "cvss_f3": 0.2081, "cvss_f3_score": 20.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 3, "fp": 0, "fn": 17, "recall": 0.15 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 22, "recall": 0.0435 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 52, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 355.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "djangoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 16, "fp": 7, "fn": 36, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6939, "recall": 0.3077, "f1": 0.4248, "f2": 0.3457, "f2_score": 34.6, "f3": 0.3256, "f3_score": 32.6, "tpr": 0.3077, "fpr": 0.5366, "youden_j": -0.2289, "cvss_coverage": 1.0, "cvss_tp_weight": 125.7, "cvss_fp_weight": 45.5, "cvss_fn_weight": 229.6, "cvss_precision": 0.7327, "cvss_recall": 0.3537, "cvss_f3": 0.3728, "cvss_f3_score": 37.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 18, "recall": 0.2174 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-013", "file": "app/views/users/work_info/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 18, "fp": 12, "fn": 34, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6109, "recall": 0.3461, "f1": 0.4405, "f2": 0.3784, "f2_score": 37.8, "f3": 0.3615, "f3_score": 36.2, "tpr": 0.3461, "fpr": 0.6623, "youden_j": -0.3162, "cvss_coverage": 1.0, "cvss_tp_weight": 139.9, "cvss_fp_weight": 66.7, "cvss_fn_weight": 215.4, "cvss_precision": 0.6792, "cvss_recall": 0.3938, "cvss_f3": 0.4109, "cvss_f3_score": 41.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 20, "fp": 10, "fn": 32, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6518, "recall": 0.375, "f1": 0.4756, "f2": 0.4096, "f2_score": 41.0, "f3": 0.3916, "f3_score": 39.1, "tpr": 0.375, "fpr": 0.6529, "youden_j": -0.2779, "cvss_coverage": 1.0, "cvss_tp_weight": 158.8, "cvss_fp_weight": 65.1, "cvss_fn_weight": 196.6, "cvss_precision": 0.7108, "cvss_recall": 0.4468, "cvss_f3": 0.4639, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 1, "fn": 1, "precision": 0.8333, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 1, "fn": 18, "recall": 0.2174 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 28, "fp": 17, "fn": 24, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6222, "recall": 0.5385, "f1": 0.5773, "f2": 0.5534, "f2_score": 55.3, "f3": 0.5458, "f3_score": 54.6, "tpr": 0.5385, "fpr": 0.7391, "youden_j": -0.2007, "cvss_coverage": 1.0, "cvss_tp_weight": 209.9, "cvss_fp_weight": 103.1, "cvss_fn_weight": 145.4, "cvss_precision": 0.6707, "cvss_recall": 0.5908, "cvss_f3": 0.5979, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 13, "recall": 0.4348 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-043", "file": "app/views/users/messages/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-023", "file": "pygoat/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 24, "fp": 11, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6895, "recall": 0.4679, "f1": 0.5559, "f2": 0.4994, "f2_score": 49.9, "f3": 0.4831, "f3_score": 48.3, "tpr": 0.4679, "fpr": 0.6445, "youden_j": -0.1765, "cvss_coverage": 1.0, "cvss_tp_weight": 182.3, "cvss_fp_weight": 64.3, "cvss_fn_weight": 173.0, "cvss_precision": 0.7417, "cvss_recall": 0.5131, "cvss_f3": 0.5289, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 3, "fn": 39, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8125, "recall": 0.25, "f1": 0.3824, "f2": 0.2902, "f2_score": 29.0, "f3": 0.2686, "f3_score": 26.9, "tpr": 0.25, "fpr": 0.3333, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 101.8, "cvss_fp_weight": 20.4, "cvss_fn_weight": 253.5, "cvss_precision": 0.833, "cvss_recall": 0.2865, "cvss_f3": 0.3066, "cvss_f3_score": 30.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 4, "fp": 0, "fn": 16, "recall": 0.2 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 20, "recall": 0.1304 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 35, "fp": 25, "fn": 17, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.6731, "f1": 0.625, "f2": 0.653, "f2_score": 65.3, "f3": 0.6629, "f3_score": 66.3, "tpr": 0.6731, "fpr": 0.8333, "youden_j": -0.1603, "cvss_coverage": 1.0, "cvss_tp_weight": 249.9, "cvss_fp_weight": 170.1, "cvss_fn_weight": 105.4, "cvss_precision": 0.595, "cvss_recall": 0.7033, "cvss_f3": 0.6908, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 1, "fn": 0, "precision": 0.8571, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 15, "fp": 0, "fn": 5, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 1, "fn": 10, "recall": 0.5652 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-049", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-041", "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-040", "file": "app/views/sessions/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-046", "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-015", "file": "template/users/work_info/index.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-023", "file": "pygoat/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-038", "file": "app/models/utils.py", "cwe": "CWE-329" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 18, "fp": 5, "fn": 34, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7826, "recall": 0.3462, "f1": 0.48, "f2": 0.3896, "f2_score": 39.0, "f3": 0.3666, "f3_score": 36.7, "tpr": 0.3462, "fpr": 0.4545, "youden_j": -0.1084, "cvss_coverage": 1.0, "cvss_tp_weight": 136.2, "cvss_fp_weight": 34.0, "cvss_fn_weight": 219.1, "cvss_precision": 0.8002, "cvss_recall": 0.3833, "cvss_f3": 0.4044, "cvss_f3_score": 40.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-043", "file": "app/views/users/messages/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 23, "fp": 27, "fn": 29, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.46, "recall": 0.4423, "f1": 0.451, "f2": 0.4457, "f2_score": 44.6, "f3": 0.444, "f3_score": 44.4, "tpr": 0.4423, "fpr": 0.8438, "youden_j": -0.4014, "cvss_coverage": 1.0, "cvss_tp_weight": 177.5, "cvss_fp_weight": 171.1, "cvss_fn_weight": 177.8, "cvss_precision": 0.5092, "cvss_recall": 0.4996, "cvss_f3": 0.5005, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 1, "fn": 1, "precision": 0.8333, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 10, "fp": 0, "fn": 10, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 1, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/utils.py", "cwe": "CWE-329" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-775" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-494" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-049", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 23, "fp": 18, "fn": 29, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.561, "recall": 0.4423, "f1": 0.4946, "f2": 0.4618, "f2_score": 46.2, "f3": 0.4519, "f3_score": 45.2, "tpr": 0.4423, "fpr": 0.7826, "youden_j": -0.3403, "cvss_coverage": 1.0, "cvss_tp_weight": 164.0, "cvss_fp_weight": 116.2, "cvss_fn_weight": 191.3, "cvss_precision": 0.5854, "cvss_recall": 0.4616, "cvss_f3": 0.4716, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 1, "fn": 3, "precision": 0.75, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 1, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-775" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-015", "file": "template/users/work_info/index.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 7, "fn": 38, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6732, "recall": 0.2756, "f1": 0.3897, "f2": 0.3121, "f2_score": 31.2, "f3": 0.2927, "f3_score": 29.3, "tpr": 0.2756, "fpr": 0.5573, "youden_j": -0.2816, "cvss_coverage": 1.0, "cvss_tp_weight": 115.3, "cvss_fp_weight": 43.6, "cvss_fn_weight": 240.0, "cvss_precision": 0.7308, "cvss_recall": 0.3244, "cvss_f3": 0.3434, "cvss_f3_score": 34.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 7, "fp": 0, "fn": 13, "recall": 0.35 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 22, "recall": 0.0435 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 6, "fn": 38, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.485, "recall": 0.2756, "f1": 0.3477, "f2": 0.3001, "f2_score": 30.0, "f3": 0.2873, "f3_score": 28.7, "tpr": 0.2756, "fpr": 0.4143, "youden_j": -0.1387, "cvss_coverage": 1.0, "cvss_tp_weight": 110.3, "cvss_fp_weight": 32.6, "cvss_fn_weight": 245.0, "cvss_precision": 0.5282, "cvss_recall": 0.3104, "cvss_f3": 0.3235, "cvss_f3_score": 32.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/views.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 18, "fp": 14, "fn": 34, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5306, "recall": 0.3462, "f1": 0.4159, "f2": 0.3707, "f2_score": 37.1, "f3": 0.3579, "f3_score": 35.8, "tpr": 0.3462, "fpr": 0.6968, "youden_j": -0.3506, "cvss_coverage": 1.0, "cvss_tp_weight": 138.3, "cvss_fp_weight": 78.6, "cvss_fn_weight": 217.0, "cvss_precision": 0.5987, "cvss_recall": 0.3893, "cvss_f3": 0.4026, "cvss_f3_score": 40.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 12, "fp": 0, "fn": 8, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-013", "file": "app/views/users/work_info/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 25, "fp": 9, "fn": 27, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7353, "recall": 0.4808, "f1": 0.5814, "f2": 0.5165, "f2_score": 51.7, "f3": 0.498, "f3_score": 49.8, "tpr": 0.4808, "fpr": 0.6, "youden_j": -0.1192, "cvss_coverage": 1.0, "cvss_tp_weight": 187.9, "cvss_fp_weight": 54.9, "cvss_fn_weight": 167.4, "cvss_precision": 0.7738, "cvss_recall": 0.5288, "cvss_f3": 0.5461, "cvss_f3_score": 54.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-013", "file": "app/views/users/work_info/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 18, "fp": 19, "fn": 34, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4865, "recall": 0.3462, "f1": 0.4045, "f2": 0.3673, "f2_score": 36.7, "f3": 0.3564, "f3_score": 35.6, "tpr": 0.3462, "fpr": 0.7917, "youden_j": -0.4455, "cvss_coverage": 1.0, "cvss_tp_weight": 133.3, "cvss_fp_weight": 154.5, "cvss_fn_weight": 222.0, "cvss_precision": 0.4632, "cvss_recall": 0.3752, "cvss_f3": 0.3824, "cvss_f3_score": 38.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 1, "fn": 5, "precision": 0.5, "recall": 0.1667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 1, "fn": 18, "recall": 0.2174 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/utils.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-041", "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 25, "fp": 75, "fn": 27, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.4808, "f1": 0.3289, "f2": 0.4058, "f2_score": 40.6, "f3": 0.4401, "f3_score": 44.0, "tpr": 0.4808, "fpr": 0.9375, "youden_j": -0.4567, "cvss_coverage": 1.0, "cvss_tp_weight": 188.3, "cvss_fp_weight": 551.0, "cvss_fn_weight": 167.0, "cvss_precision": 0.2547, "cvss_recall": 0.53, "cvss_f3": 0.4783, "cvss_f3_score": 47.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 1, "fn": 2, "precision": 0.8, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user_data.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/utils.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Analytics/analytics.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Analytics/analytics.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 24, "fp": 29, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4528, "recall": 0.4615, "f1": 0.4571, "f2": 0.4598, "f2_score": 46.0, "f3": 0.4607, "f3_score": 46.1, "tpr": 0.4615, "fpr": 0.8286, "youden_j": -0.367, "cvss_coverage": 1.0, "cvss_tp_weight": 181.6, "cvss_fp_weight": 218.0, "cvss_fn_weight": 173.7, "cvss_precision": 0.4545, "cvss_recall": 0.5111, "cvss_f3": 0.5048, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-288" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/utils.py", "cwe": "CWE-329" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 14, "fp": 15, "fn": 38, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4828, "recall": 0.2692, "f1": 0.3457, "f2": 0.2954, "f2_score": 29.5, "f3": 0.2817, "f3_score": 28.2, "tpr": 0.2692, "fpr": 0.7143, "youden_j": -0.4451, "cvss_coverage": 1.0, "cvss_tp_weight": 100.9, "cvss_fp_weight": 118.0, "cvss_fn_weight": 254.4, "cvss_precision": 0.4609, "cvss_recall": 0.284, "cvss_f3": 0.2953, "cvss_f3_score": 29.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 5, "fp": 0, "fn": 15, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/vulnerabilities/test_a1_command_injection.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/utils.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/views/test_api.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/views/test_password_reset.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/vulnerabilities/test_a3_cross_site_scripting.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/vulnerabilities/test_a4_insecure_direct_object_reference.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/vulnerabilities/test_a2_credential_enumeration.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 38, "fp": 127, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2303, "recall": 0.7308, "f1": 0.3502, "f2": 0.5094, "f2_score": 50.9, "f3": 0.6003, "f3_score": 60.0, "tpr": 0.7308, "fpr": 0.9695, "youden_j": -0.2387, "cvss_coverage": 1.0, "cvss_tp_weight": 268.4, "cvss_fp_weight": 973.0, "cvss_fn_weight": 86.9, "cvss_precision": 0.2162, "cvss_recall": 0.7554, "cvss_f3": 0.6046, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 1, "fn": 0, "precision": 0.8571, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 1, "fn": 2, "precision": 0.8333, "recall": 0.7143 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "high": { "tp": 17, "fp": 0, "fn": 3, "recall": 0.85 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 2, "fn": 10, "recall": 0.5652 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-754" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-040", "file": "app/views/sessions/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-052", "file": "app/views/users/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-045", "file": "app/views/users/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/admin/dashboard.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/admin/dashboard.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-048", "file": "static/app/javascript/users/pay/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-034", "file": "template/admin/modal.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-035", "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/table.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/dashboard/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/dashboard/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/nav_loggedin.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-046", "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/account_settings.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/messages/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/messages/index.html", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-004", "file": "template/users/messages/show.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/pay/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/pay/index.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-036", "file": "template/users/performance/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-015", "file": "template/users/work_info/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/work_info/index.html", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 44, "fp": 27, "fn": 8, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6197, "recall": 0.8462, "f1": 0.7154, "f2": 0.7885, "f2_score": 78.9, "f3": 0.8163, "f3_score": 81.6, "tpr": 0.8462, "fpr": 0.8182, "youden_j": 0.028, "cvss_coverage": 1.0, "cvss_tp_weight": 306.1, "cvss_fp_weight": 203.5, "cvss_fn_weight": 49.2, "cvss_precision": 0.6007, "cvss_recall": 0.8615, "cvss_f3": 0.8257, "cvss_f3_score": 82.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8571 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 17, "fp": 0, "fn": 3, "recall": 0.85 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 5, "recall": 0.7826 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "djangoat-014", "file": "app/models/User/user.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "djangoat-034", "file": "template/admin/modal.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-038", "file": "app/models/utils.py", "cwe": "CWE-329" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-041", "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "djangoat-040", "file": "app/views/sessions/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-026", "file": "app/views/password_resets/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-043", "file": "app/views/users/messages/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-023", "file": "pygoat/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-052", "file": "app/views/users/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-049", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-045", "file": "app/views/users/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-050", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-013", "file": "app/views/users/work_info/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-031", "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/jquery-1.12.4.min.js", "cwe": "CWE-1395" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-035", "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-036", "file": "template/users/performance/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 34, "fn": 31, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3818, "recall": 0.4038, "f1": 0.3925, "f2": 0.3992, "f2_score": 39.9, "f3": 0.4015, "f3_score": 40.2, "tpr": 0.4038, "fpr": 0.85, "youden_j": -0.4462, "cvss_coverage": 1.0, "cvss_tp_weight": 138.7, "cvss_fp_weight": 269.0, "cvss_fn_weight": 216.6, "cvss_precision": 0.3402, "cvss_recall": 0.3904, "cvss_f3": 0.3847, "cvss_f3_score": 38.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 13, "recall": 0.35 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Benefits/benefits.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-038", "file": "app/models/utils.py", "cwe": "CWE-329" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 38, "fp": 151, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2011, "recall": 0.7308, "f1": 0.3154, "f2": 0.4786, "f2_score": 47.9, "f3": 0.5784, "f3_score": 57.8, "tpr": 0.7308, "fpr": 0.9742, "youden_j": -0.2434, "cvss_coverage": 1.0, "cvss_tp_weight": 268.4, "cvss_fp_weight": 1117.5, "cvss_fn_weight": 86.9, "cvss_precision": 0.1937, "cvss_recall": 0.7554, "cvss_f3": 0.5856, "cvss_f3_score": 58.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 1, "fn": 0, "precision": 0.8571, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 1, "fn": 2, "precision": 0.8333, "recall": 0.7143 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "high": { "tp": 17, "fp": 0, "fn": 3, "recall": 0.85 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 2, "fn": 10, "recall": 0.5652 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/decorators.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "djangoat-012", "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/middleware.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-030", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Pay/pay.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-006", "file": "app/models/User/user_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/signals.py", "cwe": "CWE-754" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-022", "file": "app/views/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-044", "file": "app/views/api/mobile/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-028", "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-040", "file": "app/views/sessions/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-052", "file": "app/views/users/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-045", "file": "app/views/users/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/docker_settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "djangoat-011", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/admin/dashboard.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/admin/dashboard.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-048", "file": "static/app/javascript/users/pay/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/analytics.html", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "djangoat-034", "file": "template/admin/modal.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-035", "file": "template/admin/modal.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/table.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/dashboard/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/dashboard/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/nav_loggedin.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-046", "file": "template/layouts/shared/not_logged_in.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/account_settings.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/messages/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/messages/index.html", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-004", "file": "template/users/messages/show.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/pay/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/pay/index.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "djangoat-036", "file": "template/users/performance/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-033", "file": "template/users/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-015", "file": "template/users/work_info/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/work_info/index.html", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 13, "fp": 8, "fn": 39, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6131, "recall": 0.2436, "f1": 0.3461, "f2": 0.2761, "f2_score": 27.6, "f3": 0.2588, "f3_score": 25.9, "tpr": 0.2436, "fpr": 0.5619, "youden_j": -0.3183, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 54.4, "cvss_fn_weight": 249.3, "cvss_precision": 0.6614, "cvss_recall": 0.2985, "cvss_f3": 0.3152, "cvss_f3_score": 31.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 21, "recall": 0.087 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-021", "file": "app/views/users/messages/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-010", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-047", "file": "app/views/api/users/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 52, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 355.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "djangoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 11, "fn": 41, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.2115, "f1": 0.2973, "f2": 0.2391, "f2_score": 23.9, "f3": 0.2245, "f3_score": 22.4, "tpr": 0.2115, "fpr": 0.6875, "youden_j": -0.476, "cvss_coverage": 1.0, "cvss_tp_weight": 83.8, "cvss_fp_weight": 68.5, "cvss_fn_weight": 271.5, "cvss_precision": 0.5501, "cvss_recall": 0.2359, "cvss_f3": 0.2501, "cvss_f3_score": 25.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "high": { "tp": 3, "fp": 1, "fn": 17, "recall": 0.15 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "djangoat-fp-001", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-007", "file": "app/views/users/benefit_forms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "djangoat-009", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "djangoat-016", "file": "app/views/sessions/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-017", "file": "app/views/password_resets/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "djangoat-008", "file": "app/views/sessions/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/WorkInfo/work_info.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "djangoat-042", "file": "pygoat/docker_settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/work_info/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "rowan": { "scanner": "rowan", "tp": 12, "fp": 30, "fn": 40, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.2308, "f1": 0.2553, "f2": 0.24, "f2_score": 24.0, "f3": 0.2353, "f3_score": 23.5, "tpr": 0.2308, "fpr": 0.8333, "youden_j": -0.6026, "cvss_coverage": 1.0, "cvss_tp_weight": 92.5, "cvss_fp_weight": 91.5, "cvss_fn_weight": 262.8, "cvss_precision": 0.5027, "cvss_recall": 0.2603, "cvss_f3": 0.2735, "cvss_f3_score": 27.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 3, "fp": 0, "fn": 17, "recall": 0.15 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-032", "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/views/test_password_reset.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tests/views/test_users.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "djangoat-018", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-020", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-019", "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "djangoat-024", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "djangoat-006", "file": "app/models/Benefits/benefits.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/jquery-1.12.4.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/admin/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app/javascript/loader.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "semgrep": { "scanner": "semgrep", "tp": 11, "fp": 38, "fn": 41, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.2245, "recall": 0.2115, "f1": 0.2178, "f2": 0.214, "f2_score": 21.4, "f3": 0.2128, "f3_score": 21.3, "tpr": 0.2115, "fpr": 0.8636, "youden_j": -0.6521, "cvss_coverage": 1.0, "cvss_tp_weight": 81.3, "cvss_fp_weight": 258.5, "cvss_fn_weight": 274.0, "cvss_precision": 0.2392, "cvss_recall": 0.2288, "cvss_f3": 0.2298, "cvss_f3_score": 23.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "high": { "tp": 1, "fp": 0, "fn": 19, "recall": 0.05 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 18, "recall": 0.2174 } }, "details": [ { "classification": "TP", "ground_truth_id": "djangoat-002", "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/Analytics/analytics.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/User/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-027", "file": "app/models/User/user.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-004", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "djangoat-005", "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/mobile/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/api/users/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/dashboard/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/index.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/index.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-025", "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "djangoat-003", "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/password_resets/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "djangoat-029", "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/sessions/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/paid_time_off/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/pay/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/performance/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/performance/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-051", "file": "app/views/users/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-001", "file": "app/views/users/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/users/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "djangoat-049", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "djangoat-050", "file": "app/views/users/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/analytics.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/analytics.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/analytics.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/analytics.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/admin/modal_notFound.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/password_reset/reset.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/sessions/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/benefit_forms.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/pay/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "template/users/performance/index.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "djangoat-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 52, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 355.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "djangoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "djangoat-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "djangoat-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "djangoat-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "djangoat-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "djangoat-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "djangoat-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-016", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "djangoat-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-019", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "djangoat-024", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "djangoat-025", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-026", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-028", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "djangoat-029", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "djangoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "djangoat-032", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "djangoat-033", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-034", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "djangoat-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-036", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-037", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "djangoat-038", "file": null, "cwe": "CWE-329" }, { "classification": "FN", "ground_truth_id": "djangoat-039", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "djangoat-040", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "djangoat-041", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "djangoat-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-043", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "djangoat-044", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "djangoat-045", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "djangoat-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-047", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "djangoat-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "djangoat-050", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "djangoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "djangoat-051", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "djangoat-052", "file": null, "cwe": "CWE-256" } ] } }, "realvuln-dsvpwa": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 28, "fp": 10, "fn": 4, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.875, "f1": 0.8, "f2": 0.8434, "f2_score": 84.3, "f3": 0.8589, "f3_score": 85.9, "tpr": 0.875, "fpr": 0.625, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 186.5, "cvss_fp_weight": 54.7, "cvss_fn_weight": 21.5, "cvss_precision": 0.7731, "cvss_recall": 0.8966, "cvss_f3": 0.8825, "cvss_f3_score": 88.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-757" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 8, "fn": 13, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7037, "recall": 0.5938, "f1": 0.6441, "f2": 0.6129, "f2_score": 61.3, "f3": 0.6032, "f3_score": 60.3, "tpr": 0.5938, "fpr": 0.5714, "youden_j": 0.0223, "cvss_coverage": 1.0, "cvss_tp_weight": 134.5, "cvss_fp_weight": 38.8, "cvss_fn_weight": 73.5, "cvss_precision": 0.776, "cvss_recall": 0.6466, "cvss_f3": 0.6576, "cvss_f3_score": 65.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 24, "fp": 9, "fn": 8, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7339, "recall": 0.7396, "f1": 0.7365, "f2": 0.7383, "f2_score": 73.8, "f3": 0.7389, "f3_score": 73.9, "tpr": 0.7396, "fpr": 0.5967, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 159.7, "cvss_fp_weight": 32.5, "cvss_fn_weight": 48.3, "cvss_precision": 0.834, "cvss_recall": 0.7676, "cvss_f3": 0.7736, "cvss_f3_score": 77.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 22, "fp": 6, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7975, "recall": 0.6875, "f1": 0.7373, "f2": 0.7064, "f2_score": 70.6, "f3": 0.6968, "f3_score": 69.7, "tpr": 0.6875, "fpr": 0.4795, "youden_j": 0.208, "cvss_coverage": 1.0, "cvss_tp_weight": 151.2, "cvss_fp_weight": 21.1, "cvss_fn_weight": 56.8, "cvss_precision": 0.8789, "cvss_recall": 0.7269, "cvss_f3": 0.7395, "cvss_f3_score": 74.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 25, "fp": 5, "fn": 7, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.7812, "f1": 0.8065, "f2": 0.7911, "f2_score": 79.1, "f3": 0.7862, "f3_score": 78.6, "tpr": 0.7812, "fpr": 0.4545, "youden_j": 0.3267, "cvss_coverage": 1.0, "cvss_tp_weight": 167.9, "cvss_fp_weight": 27.4, "cvss_fn_weight": 40.1, "cvss_precision": 0.8598, "cvss_recall": 0.8072, "cvss_f3": 0.8122, "cvss_f3_score": 81.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 1, "fn": 18, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.4375, "f1": 0.5957, "f2": 0.4895, "f2_score": 49.0, "f3": 0.462, "f3_score": 46.2, "tpr": 0.4375, "fpr": 0.1429, "youden_j": 0.2946, "cvss_coverage": 1.0, "cvss_tp_weight": 104.8, "cvss_fp_weight": 5.5, "cvss_fn_weight": 103.2, "cvss_precision": 0.9504, "cvss_recall": 0.5038, "cvss_f3": 0.5287, "cvss_f3_score": 52.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 14, "fp": 1, "fn": 18, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.4375, "f1": 0.5957, "f2": 0.4895, "f2_score": 49.0, "f3": 0.462, "f3_score": 46.2, "tpr": 0.4375, "fpr": 0.1429, "youden_j": 0.2946, "cvss_coverage": 1.0, "cvss_tp_weight": 107.9, "cvss_fp_weight": 0.5, "cvss_fn_weight": 100.1, "cvss_precision": 0.9954, "cvss_recall": 0.5188, "cvss_f3": 0.5448, "cvss_f3_score": 54.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 17, "fp": 2, "fn": 15, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8846, "recall": 0.5416, "f1": 0.6713, "f2": 0.5869, "f2_score": 58.7, "f3": 0.5634, "f3_score": 56.3, "tpr": 0.5416, "fpr": 0.2643, "youden_j": 0.2774, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 11.1, "cvss_fn_weight": 86.5, "cvss_precision": 0.9173, "cvss_recall": 0.584, "cvss_f3": 0.6059, "cvss_f3_score": 60.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 21, "fp": 7, "fn": 11, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7494, "recall": 0.6458, "f1": 0.6926, "f2": 0.6635, "f2_score": 66.4, "f3": 0.6545, "f3_score": 65.5, "tpr": 0.6458, "fpr": 0.531, "youden_j": 0.1148, "cvss_coverage": 1.0, "cvss_tp_weight": 143.4, "cvss_fp_weight": 31.7, "cvss_fn_weight": 64.6, "cvss_precision": 0.8245, "cvss_recall": 0.6893, "cvss_f3": 0.7001, "cvss_f3_score": 70.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 4, "fn": 16, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.533, "recall": 0.4896, "f1": 0.5101, "f2": 0.4975, "f2_score": 49.7, "f3": 0.4935, "f3_score": 49.3, "tpr": 0.4896, "fpr": 0.3238, "youden_j": 0.1658, "cvss_coverage": 1.0, "cvss_tp_weight": 106.1, "cvss_fp_weight": 20.2, "cvss_fn_weight": 101.9, "cvss_precision": 0.5605, "cvss_recall": 0.51, "cvss_f3": 0.5146, "cvss_f3_score": 51.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dsvpwa-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-007", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 26, "fp": 13, "fn": 6, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.8125, "f1": 0.7324, "f2": 0.7784, "f2_score": 77.8, "f3": 0.7951, "f3_score": 79.5, "tpr": 0.8125, "fpr": 0.6842, "youden_j": 0.1283, "cvss_coverage": 1.0, "cvss_tp_weight": 177.2, "cvss_fp_weight": 61.2, "cvss_fn_weight": 30.8, "cvss_precision": 0.7433, "cvss_recall": 0.8519, "cvss_f3": 0.8396, "cvss_f3_score": 84.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-698" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "db/users.xml", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 24, "fp": 8, "fn": 8, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7365, "recall": 0.7344, "f1": 0.7338, "f2": 0.7338, "f2_score": 73.4, "f3": 0.734, "f3_score": 73.4, "tpr": 0.7344, "fpr": 0.5817, "youden_j": 0.1526, "cvss_coverage": 1.0, "cvss_tp_weight": 158.7, "cvss_fp_weight": 36.6, "cvss_fn_weight": 49.3, "cvss_precision": 0.815, "cvss_recall": 0.763, "cvss_f3": 0.7673, "cvss_f3_score": 76.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 1, "fn": 16, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9412, "recall": 0.5, "f1": 0.6531, "f2": 0.5517, "f2_score": 55.2, "f3": 0.5246, "f3_score": 52.5, "tpr": 0.5, "fpr": 0.1429, "youden_j": 0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 118.9, "cvss_fp_weight": 5.5, "cvss_fn_weight": 89.1, "cvss_precision": 0.956, "cvss_recall": 0.5716, "cvss_f3": 0.5956, "cvss_f3_score": 59.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 23, "fp": 12, "fn": 9, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6571, "recall": 0.7188, "f1": 0.6866, "f2": 0.7055, "f2_score": 70.6, "f3": 0.7121, "f3_score": 71.2, "tpr": 0.7188, "fpr": 0.6667, "youden_j": 0.0521, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 60.7, "cvss_fn_weight": 49.4, "cvss_precision": 0.7232, "cvss_recall": 0.7625, "cvss_f3": 0.7584, "cvss_f3_score": 75.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-698" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 19, "fp": 2, "fn": 13, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9048, "recall": 0.5938, "f1": 0.717, "f2": 0.6376, "f2_score": 63.8, "f3": 0.6149, "f3_score": 61.5, "tpr": 0.5938, "fpr": 0.25, "youden_j": 0.3438, "cvss_coverage": 1.0, "cvss_tp_weight": 137.1, "cvss_fp_weight": 10.9, "cvss_fn_weight": 70.9, "cvss_precision": 0.9261, "cvss_recall": 0.6591, "cvss_f3": 0.6787, "cvss_f3_score": 67.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 19, "fn": 8, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5581, "recall": 0.75, "f1": 0.64, "f2": 0.7018, "f2_score": 70.2, "f3": 0.7251, "f3_score": 72.5, "tpr": 0.75, "fpr": 0.76, "youden_j": -0.01, "cvss_coverage": 1.0, "cvss_tp_weight": 165.2, "cvss_fp_weight": 94.1, "cvss_fn_weight": 42.8, "cvss_precision": 0.6372, "cvss_recall": 0.7942, "cvss_f3": 0.7751, "cvss_f3_score": 77.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-025", "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 30, "fp": 14, "fn": 2, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.9375, "f1": 0.7895, "f2": 0.8721, "f2_score": 87.2, "f3": 0.9036, "f3_score": 90.4, "tpr": 0.9375, "fpr": 0.7, "youden_j": 0.2375, "cvss_coverage": 1.0, "cvss_tp_weight": 194.6, "cvss_fp_weight": 61.7, "cvss_fn_weight": 13.4, "cvss_precision": 0.7592, "cvss_recall": 0.9356, "cvss_f3": 0.9143, "cvss_f3_score": 91.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "dsvpwa-025", "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 17, "fp": 5, "fn": 15, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7876, "recall": 0.5417, "f1": 0.6417, "f2": 0.5776, "f2_score": 57.7, "f3": 0.5591, "f3_score": 55.9, "tpr": 0.5417, "fpr": 0.4333, "youden_j": 0.1083, "cvss_coverage": 1.0, "cvss_tp_weight": 122.1, "cvss_fp_weight": 20.6, "cvss_fn_weight": 85.9, "cvss_precision": 0.855, "cvss_recall": 0.5872, "cvss_f3": 0.6061, "cvss_f3_score": 60.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 20, "fp": 4, "fn": 12, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8296, "recall": 0.6406, "f1": 0.7204, "f2": 0.6699, "f2_score": 67.0, "f3": 0.6549, "f3_score": 65.5, "tpr": 0.6406, "fpr": 0.3942, "youden_j": 0.2464, "cvss_coverage": 1.0, "cvss_tp_weight": 140.9, "cvss_fp_weight": 14.7, "cvss_fn_weight": 67.1, "cvss_precision": 0.9088, "cvss_recall": 0.6774, "cvss_f3": 0.6949, "cvss_f3_score": 69.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 22, "fp": 4, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8436, "recall": 0.6979, "f1": 0.7615, "f2": 0.7216, "f2_score": 72.2, "f3": 0.7095, "f3_score": 70.9, "tpr": 0.6979, "fpr": 0.3962, "youden_j": 0.3017, "cvss_coverage": 1.0, "cvss_tp_weight": 151.8, "cvss_fp_weight": 17.1, "cvss_fn_weight": 56.2, "cvss_precision": 0.9023, "cvss_recall": 0.7298, "cvss_f3": 0.7436, "cvss_f3_score": 74.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 23, "fp": 5, "fn": 9, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8214, "recall": 0.7188, "f1": 0.7667, "f2": 0.7372, "f2_score": 73.7, "f3": 0.7278, "f3_score": 72.8, "tpr": 0.7188, "fpr": 0.4545, "youden_j": 0.2642, "cvss_coverage": 1.0, "cvss_tp_weight": 155.2, "cvss_fp_weight": 22.4, "cvss_fn_weight": 52.8, "cvss_precision": 0.8739, "cvss_recall": 0.7462, "cvss_f3": 0.7572, "cvss_f3_score": 75.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 14, "fp": 1, "fn": 18, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.4375, "f1": 0.5957, "f2": 0.4895, "f2_score": 49.0, "f3": 0.462, "f3_score": 46.2, "tpr": 0.4375, "fpr": 0.1429, "youden_j": 0.2946, "cvss_coverage": 1.0, "cvss_tp_weight": 104.4, "cvss_fp_weight": 5.5, "cvss_fn_weight": 103.6, "cvss_precision": 0.95, "cvss_recall": 0.5019, "cvss_f3": 0.5268, "cvss_f3_score": 52.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 29, "fp": 31, "fn": 3, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4833, "recall": 0.9062, "f1": 0.6304, "f2": 0.7713, "f2_score": 77.1, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.9062, "fpr": 0.8611, "youden_j": 0.0451, "cvss_coverage": 1.0, "cvss_tp_weight": 193.0, "cvss_fp_weight": 247.0, "cvss_fn_weight": 15.0, "cvss_precision": 0.4386, "cvss_recall": 0.9279, "cvss_f3": 0.8348, "cvss_f3_score": 83.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "dsvpwa-fp-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-025", "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-757" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 28, "fp": 16, "fn": 4, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.875, "f1": 0.7368, "f2": 0.814, "f2_score": 81.4, "f3": 0.8434, "f3_score": 84.3, "tpr": 0.875, "fpr": 0.7273, "youden_j": 0.1477, "cvss_coverage": 1.0, "cvss_tp_weight": 189.0, "cvss_fp_weight": 107.5, "cvss_fn_weight": 19.0, "cvss_precision": 0.6374, "cvss_recall": 0.9087, "cvss_f3": 0.8716, "cvss_f3_score": 87.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-025", "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 6, "fp": 0, "fn": 26, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.1875, "f1": 0.3158, "f2": 0.2239, "f2_score": 22.4, "f3": 0.2041, "f3_score": 20.4, "tpr": 0.1875, "fpr": 0.0, "youden_j": 0.1875, "cvss_coverage": 1.0, "cvss_tp_weight": 40.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 167.5, "cvss_precision": 1.0, "cvss_recall": 0.1947, "cvss_f3": 0.2118, "cvss_f3_score": 21.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-007", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 44, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3623, "recall": 0.7812, "f1": 0.495, "f2": 0.6345, "f2_score": 63.5, "f3": 0.7003, "f3_score": 70.0, "tpr": 0.7812, "fpr": 0.898, "youden_j": -0.1167, "cvss_coverage": 1.0, "cvss_tp_weight": 167.1, "cvss_fp_weight": 314.5, "cvss_fn_weight": 40.9, "cvss_precision": 0.347, "cvss_recall": 0.8034, "cvss_f3": 0.71, "cvss_f3_score": 71.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 1, "fn": 2, "recall": 0.7778 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docs/secret.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docs/secret.txt", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-757" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "dsvpwa-fp-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 2, "fn": 7, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9259, "recall": 0.7812, "f1": 0.8475, "f2": 0.8065, "f2_score": 80.6, "f3": 0.7937, "f3_score": 79.4, "tpr": 0.7812, "fpr": 0.25, "youden_j": 0.5312, "cvss_coverage": 1.0, "cvss_tp_weight": 160.1, "cvss_fp_weight": 16.0, "cvss_fn_weight": 47.9, "cvss_precision": 0.9091, "cvss_recall": 0.7697, "cvss_f3": 0.7817, "cvss_f3_score": 78.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-017", "file": "db/users.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-030", "file": "dsvpwa/handlers.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-023", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvpwa-025", "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 22, "fp": 3, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.88, "recall": 0.6875, "f1": 0.7719, "f2": 0.719, "f2_score": 71.9, "f3": 0.7029, "f3_score": 70.3, "tpr": 0.6875, "fpr": 0.3333, "youden_j": 0.3542, "cvss_coverage": 1.0, "cvss_tp_weight": 150.6, "cvss_fp_weight": 21.5, "cvss_fn_weight": 57.4, "cvss_precision": 0.8751, "cvss_recall": 0.724, "cvss_f3": 0.7368, "cvss_f3_score": 73.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-011", "file": "dsvpwa/attacks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 26, "fp": 54, "fn": 6, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.325, "recall": 0.8125, "f1": 0.4643, "f2": 0.625, "f2_score": 62.5, "f3": 0.7065, "f3_score": 70.7, "tpr": 0.8125, "fpr": 0.9153, "youden_j": -0.1028, "cvss_coverage": 1.0, "cvss_tp_weight": 173.4, "cvss_fp_weight": 369.5, "cvss_fn_weight": 34.6, "cvss_precision": 0.3194, "cvss_recall": 0.8337, "cvss_f3": 0.718, "cvss_f3_score": 71.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 1, "fn": 2, "recall": 0.7778 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docs/secret.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docs/secret.txt", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-757" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-018", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "dsvpwa-fp-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-029", "file": "dsvpwa/attacks.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-019", "file": "dsvpwa/attacks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dsvpwa-013", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/dsvpwa.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/dsvpwa.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-028", "file": "dsvpwa/handlers.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvpwa-031", "file": "dsvpwa/handlers.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-024", "file": "templates/login.html", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 12, "fp": 3, "fn": 20, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8035, "recall": 0.375, "f1": 0.5109, "f2": 0.4196, "f2_score": 42.0, "f3": 0.3961, "f3_score": 39.6, "tpr": 0.375, "fpr": 0.325, "youden_j": 0.05, "cvss_coverage": 1.0, "cvss_tp_weight": 89.9, "cvss_fp_weight": 16.4, "cvss_fn_weight": 118.1, "cvss_precision": 0.8478, "cvss_recall": 0.4322, "cvss_f3": 0.4545, "cvss_f3_score": 45.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "db/users.xml", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvpwa-021", "file": "dsvpwa/handlers.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 208.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dsvpwa-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-007", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 16, "fp": 7, "fn": 16, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5, "f1": 0.5818, "f2": 0.5298, "f2_score": 53.0, "f3": 0.5145, "f3_score": 51.4, "tpr": 0.5, "fpr": 0.5385, "youden_j": -0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 114.1, "cvss_fp_weight": 33.3, "cvss_fn_weight": 93.9, "cvss_precision": 0.7739, "cvss_recall": 0.5486, "cvss_f3": 0.565, "cvss_f3_score": 56.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-003", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-004", "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-008", "file": "dsvpwa/attacks.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvpwa-009", "file": "dsvpwa/attacks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvpwa-005", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-027", "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvpwa-010", "file": "dsvpwa/attacks.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dsvpwa-016", "file": "dsvpwa/attacks.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-022", "file": "dsvpwa/handlers.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvpwa-020", "file": "dsvpwa.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "dsvpwa-012", "file": "dsvpwa/attacks.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 14, "fn": 26, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3, "recall": 0.1875, "f1": 0.2308, "f2": 0.2027, "f2_score": 20.3, "f3": 0.1948, "f3_score": 19.5, "tpr": 0.1875, "fpr": 0.7, "youden_j": -0.5125, "cvss_coverage": 1.0, "cvss_tp_weight": 50.0, "cvss_fp_weight": 44.0, "cvss_fn_weight": 158.0, "cvss_precision": 0.5319, "cvss_recall": 0.2404, "cvss_f3": 0.2543, "cvss_f3_score": 25.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 12, "recall": 0.1429 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/bootstrap.bundle.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/bootstrap.bundle.min.js", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvpwa-026", "file": "dsvpwa/handlers.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/jquery.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/handlers.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/server.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/jquery.min.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 7, "fn": 26, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.1875, "f1": 0.2667, "f2": 0.2128, "f2_score": 21.3, "f3": 0.1993, "f3_score": 19.9, "tpr": 0.1875, "fpr": 0.5385, "youden_j": -0.351, "cvss_coverage": 1.0, "cvss_tp_weight": 52.8, "cvss_fp_weight": 38.3, "cvss_fn_weight": 155.2, "cvss_precision": 0.5795, "cvss_recall": 0.2538, "cvss_f3": 0.269, "cvss_f3_score": 26.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "dsvpwa-001", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-006", "file": "dsvpwa/attacks.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvpwa-007", "file": "dsvpwa/attacks.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvpwa/attacks.py", "cwe": "CWE-939" }, { "classification": "TP", "ground_truth_id": "dsvpwa-002", "file": "dsvpwa/attacks.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvpwa-014", "file": "dsvpwa/handlers.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "ssl/key.pem", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvpwa-015", "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/custom.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 32, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 208.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dsvpwa-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-007", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvpwa-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvpwa-010", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dsvpwa-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvpwa-013", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "dsvpwa-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvpwa-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvpwa-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvpwa-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-020", "file": null, "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "dsvpwa-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvpwa-022", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-023", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvpwa-024", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "dsvpwa-025", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "dsvpwa-026", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvpwa-027", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvpwa-028", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvpwa-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvpwa-030", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dsvpwa-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvpwa-032", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvpwa-fp-006", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-dsvw": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 26, "fp": 8, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.963, "f1": 0.8525, "f2": 0.9155, "f2_score": 91.5, "f3": 0.9386, "f3_score": 93.9, "tpr": 0.963, "fpr": 0.6667, "youden_j": 0.2963, "cvss_coverage": 1.0, "cvss_tp_weight": 163.8, "cvss_fp_weight": 32.9, "cvss_fn_weight": 5.3, "cvss_precision": 0.8326, "cvss_recall": 0.9687, "cvss_f3": 0.9531, "cvss_f3_score": 95.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvw-024", "file": "dsvw.py", "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 20, "fp": 6, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.7407, "f1": 0.7547, "f2": 0.7463, "f2_score": 74.6, "f3": 0.7435, "f3_score": 74.3, "tpr": 0.7407, "fpr": 0.6, "youden_j": 0.1407, "cvss_coverage": 1.0, "cvss_tp_weight": 133.2, "cvss_fp_weight": 31.9, "cvss_fn_weight": 35.9, "cvss_precision": 0.8066, "cvss_recall": 0.7877, "cvss_f3": 0.7896, "cvss_f3_score": 79.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 19, "fp": 2, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8966, "recall": 0.716, "f1": 0.7955, "f2": 0.7457, "f2_score": 74.6, "f3": 0.7306, "f3_score": 73.0, "tpr": 0.716, "fpr": 0.3095, "youden_j": 0.4065, "cvss_coverage": 1.0, "cvss_tp_weight": 128.8, "cvss_fp_weight": 14.7, "cvss_fn_weight": 40.3, "cvss_precision": 0.9019, "cvss_recall": 0.7617, "cvss_f3": 0.7735, "cvss_f3_score": 77.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 20, "fp": 3, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8851, "recall": 0.7531, "f1": 0.8135, "f2": 0.7761, "f2_score": 77.6, "f3": 0.7644, "f3_score": 76.4, "tpr": 0.7531, "fpr": 0.3889, "youden_j": 0.3642, "cvss_coverage": 1.0, "cvss_tp_weight": 133.9, "cvss_fp_weight": 16.8, "cvss_fn_weight": 35.2, "cvss_precision": 0.8896, "cvss_recall": 0.7918, "cvss_f3": 0.8006, "cvss_f3_score": 80.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 0, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7037, "f1": 0.8261, "f2": 0.748, "f2_score": 74.8, "f3": 0.7252, "f3_score": 72.5, "tpr": 0.7037, "fpr": 0.0, "youden_j": 0.7037, "cvss_coverage": 1.0, "cvss_tp_weight": 127.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 41.2, "cvss_precision": 1.0, "cvss_recall": 0.7564, "cvss_f3": 0.7752, "cvss_f3_score": 77.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 13, "fp": 0, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4815, "f1": 0.65, "f2": 0.5372, "f2_score": 53.7, "f3": 0.5078, "f3_score": 50.8, "tpr": 0.4815, "fpr": 0.0, "youden_j": 0.4815, "cvss_coverage": 1.0, "cvss_tp_weight": 95.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 73.6, "cvss_precision": 1.0, "cvss_recall": 0.5648, "cvss_f3": 0.5905, "cvss_f3_score": 59.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 17, "fp": 4, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8229, "recall": 0.642, "f1": 0.7155, "f2": 0.6684, "f2_score": 66.8, "f3": 0.6548, "f3_score": 65.5, "tpr": 0.642, "fpr": 0.4661, "youden_j": 0.1759, "cvss_coverage": 1.0, "cvss_tp_weight": 120.0, "cvss_fp_weight": 23.2, "cvss_fn_weight": 49.1, "cvss_precision": 0.8443, "cvss_recall": 0.7096, "cvss_f3": 0.72, "cvss_f3_score": 72.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-87" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-87" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 20, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8345, "recall": 0.7407, "f1": 0.7842, "f2": 0.7574, "f2_score": 75.7, "f3": 0.749, "f3_score": 74.9, "tpr": 0.7407, "fpr": 0.4947, "youden_j": 0.246, "cvss_coverage": 1.0, "cvss_tp_weight": 134.0, "cvss_fp_weight": 23.2, "cvss_fn_weight": 35.1, "cvss_precision": 0.8539, "cvss_recall": 0.7924, "cvss_f3": 0.7979, "cvss_f3_score": 79.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 21, "fp": 13, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6246, "recall": 0.7778, "f1": 0.6922, "f2": 0.7409, "f2_score": 74.1, "f3": 0.7588, "f3_score": 75.9, "tpr": 0.7778, "fpr": 0.7586, "youden_j": 0.0192, "cvss_coverage": 1.0, "cvss_tp_weight": 138.3, "cvss_fp_weight": 66.1, "cvss_fn_weight": 30.8, "cvss_precision": 0.6786, "cvss_recall": 0.8179, "cvss_f3": 0.8009, "cvss_f3_score": 80.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-027", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-644" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 5, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8214, "recall": 0.8519, "f1": 0.8364, "f2": 0.8456, "f2_score": 84.6, "f3": 0.8487, "f3_score": 84.9, "tpr": 0.8519, "fpr": 0.5556, "youden_j": 0.2963, "cvss_coverage": 1.0, "cvss_tp_weight": 147.3, "cvss_fp_weight": 19.9, "cvss_fn_weight": 21.8, "cvss_precision": 0.8812, "cvss_recall": 0.8711, "cvss_f3": 0.8721, "cvss_f3_score": 87.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 19, "fp": 1, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9387, "recall": 0.716, "f1": 0.8116, "f2": 0.7513, "f2_score": 75.1, "f3": 0.7333, "f3_score": 73.3, "tpr": 0.716, "fpr": 0.2095, "youden_j": 0.5065, "cvss_coverage": 1.0, "cvss_tp_weight": 131.9, "cvss_fp_weight": 8.4, "cvss_fn_weight": 37.2, "cvss_precision": 0.9431, "cvss_recall": 0.7802, "cvss_f3": 0.7938, "cvss_f3_score": 79.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 18, "fp": 1, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9474, "recall": 0.6667, "f1": 0.7826, "f2": 0.7087, "f2_score": 70.9, "f3": 0.687, "f3_score": 68.7, "tpr": 0.6667, "fpr": 0.2, "youden_j": 0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 124.8, "cvss_fp_weight": 6.3, "cvss_fn_weight": 44.3, "cvss_precision": 0.952, "cvss_recall": 0.738, "cvss_f3": 0.755, "cvss_f3_score": 75.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 2, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.7407, "f1": 0.8163, "f2": 0.7692, "f2_score": 76.9, "f3": 0.7547, "f3_score": 75.5, "tpr": 0.7407, "fpr": 0.3333, "youden_j": 0.4074, "cvss_coverage": 1.0, "cvss_tp_weight": 135.2, "cvss_fp_weight": 12.6, "cvss_fn_weight": 33.9, "cvss_precision": 0.9149, "cvss_recall": 0.7995, "cvss_f3": 0.8097, "cvss_f3_score": 81.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 20, "fp": 1, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9524, "recall": 0.7407, "f1": 0.8333, "f2": 0.7752, "f2_score": 77.5, "f3": 0.7576, "f3_score": 75.8, "tpr": 0.7407, "fpr": 0.2, "youden_j": 0.5407, "cvss_coverage": 1.0, "cvss_tp_weight": 135.2, "cvss_fp_weight": 6.3, "cvss_fn_weight": 33.9, "cvss_precision": 0.9556, "cvss_recall": 0.7995, "cvss_f3": 0.8128, "cvss_f3_score": 81.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 21, "fp": 5, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8077, "recall": 0.7778, "f1": 0.7925, "f2": 0.7836, "f2_score": 78.4, "f3": 0.7807, "f3_score": 78.1, "tpr": 0.7778, "fpr": 0.5556, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 142.7, "cvss_fp_weight": 31.4, "cvss_fn_weight": 26.4, "cvss_precision": 0.8195, "cvss_recall": 0.8439, "cvss_f3": 0.8414, "cvss_f3_score": 84.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 26, "fp": 2, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.963, "f1": 0.9455, "f2": 0.9559, "f2_score": 95.6, "f3": 0.9594, "f3_score": 95.9, "tpr": 0.963, "fpr": 0.3333, "youden_j": 0.6296, "cvss_coverage": 1.0, "cvss_tp_weight": 163.8, "cvss_fp_weight": 6.8, "cvss_fn_weight": 5.3, "cvss_precision": 0.9602, "cvss_recall": 0.9687, "cvss_f3": 0.9678, "cvss_f3_score": 96.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvw-024", "file": "dsvw.py", "cwe": "CWE-235" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 18, "fp": 2, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8891, "recall": 0.6543, "f1": 0.7511, "f2": 0.6894, "f2_score": 68.9, "f3": 0.6714, "f3_score": 67.1, "tpr": 0.6543, "fpr": 0.3444, "youden_j": 0.3099, "cvss_coverage": 1.0, "cvss_tp_weight": 122.4, "cvss_fp_weight": 14.7, "cvss_fn_weight": 46.7, "cvss_precision": 0.8978, "cvss_recall": 0.7236, "cvss_f3": 0.7373, "cvss_f3_score": 73.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 18, "fp": 1, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9565, "recall": 0.679, "f1": 0.7909, "f2": 0.7192, "f2_score": 71.9, "f3": 0.6985, "f3_score": 69.9, "tpr": 0.679, "fpr": 0.1429, "youden_j": 0.5362, "cvss_coverage": 1.0, "cvss_tp_weight": 125.8, "cvss_fp_weight": 6.3, "cvss_fn_weight": 43.3, "cvss_precision": 0.9589, "cvss_recall": 0.7441, "cvss_f3": 0.7605, "cvss_f3_score": 76.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 19, "fp": 2, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.896, "recall": 0.716, "f1": 0.7948, "f2": 0.7454, "f2_score": 74.5, "f3": 0.7304, "f3_score": 73.0, "tpr": 0.716, "fpr": 0.3444, "youden_j": 0.3716, "cvss_coverage": 1.0, "cvss_tp_weight": 133.4, "cvss_fp_weight": 14.7, "cvss_fn_weight": 35.7, "cvss_precision": 0.9043, "cvss_recall": 0.7889, "cvss_f3": 0.7987, "cvss_f3_score": 79.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 22, "fp": 4, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8462, "recall": 0.8148, "f1": 0.8302, "f2": 0.8209, "f2_score": 82.1, "f3": 0.8178, "f3_score": 81.8, "tpr": 0.8148, "fpr": 0.5, "youden_j": 0.3148, "cvss_coverage": 1.0, "cvss_tp_weight": 143.0, "cvss_fp_weight": 19.4, "cvss_fn_weight": 26.1, "cvss_precision": 0.8808, "cvss_recall": 0.8457, "cvss_f3": 0.849, "cvss_f3_score": 84.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 18, "fp": 0, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.6667, "f1": 0.8, "f2": 0.7143, "f2_score": 71.4, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.6667, "fpr": 0.0, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 120.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 49.1, "cvss_precision": 1.0, "cvss_recall": 0.7096, "cvss_f3": 0.7309, "cvss_f3_score": 73.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 25, "fp": 22, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5319, "recall": 0.9259, "f1": 0.6757, "f2": 0.8065, "f2_score": 80.6, "f3": 0.8621, "f3_score": 86.2, "tpr": 0.9259, "fpr": 0.8462, "youden_j": 0.0798, "cvss_coverage": 1.0, "cvss_tp_weight": 159.3, "cvss_fp_weight": 164.0, "cvss_fn_weight": 9.8, "cvss_precision": 0.4927, "cvss_recall": 0.942, "cvss_f3": 0.8633, "cvss_f3_score": 86.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dsvw-027", "file": "dsvw.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 25, "fp": 13, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6579, "recall": 0.9259, "f1": 0.7692, "f2": 0.8562, "f2_score": 85.6, "f3": 0.8897, "f3_score": 89.0, "tpr": 0.9259, "fpr": 0.7647, "youden_j": 0.1612, "cvss_coverage": 1.0, "cvss_tp_weight": 157.9, "cvss_fp_weight": 92.5, "cvss_fn_weight": 11.2, "cvss_precision": 0.6306, "cvss_recall": 0.9338, "cvss_f3": 0.8909, "cvss_f3_score": 89.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvw-027", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.037, "f1": 0.0714, "f2": 0.0459, "f2_score": 4.6, "f3": 0.041, "f3_score": 4.1, "tpr": 0.037, "fpr": 0.0, "youden_j": 0.037, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 163.0, "cvss_precision": 1.0, "cvss_recall": 0.0361, "cvss_f3": 0.0399, "cvss_f3_score": 4.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvw-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvw-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvw-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvw-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dsvw-008", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dsvw-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dsvw-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-012", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "dsvw-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-015", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 21, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5435, "recall": 0.9259, "f1": 0.6849, "f2": 0.8117, "f2_score": 81.2, "f3": 0.8651, "f3_score": 86.5, "tpr": 0.9259, "fpr": 0.84, "youden_j": 0.0859, "cvss_coverage": 1.0, "cvss_tp_weight": 160.1, "cvss_fp_weight": 157.0, "cvss_fn_weight": 9.0, "cvss_precision": 0.5049, "cvss_recall": 0.9468, "cvss_f3": 0.8706, "cvss_f3_score": 87.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-93" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 1, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.95, "recall": 0.7037, "f1": 0.8085, "f2": 0.7422, "f2_score": 74.2, "f3": 0.7224, "f3_score": 72.2, "tpr": 0.7037, "fpr": 0.2, "youden_j": 0.5037, "cvss_coverage": 1.0, "cvss_tp_weight": 117.4, "cvss_fp_weight": 5.5, "cvss_fn_weight": 51.7, "cvss_precision": 0.9552, "cvss_recall": 0.6943, "cvss_f3": 0.7138, "cvss_f3_score": 71.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-027", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvw-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dsvw-008", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dsvw-012", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 23, "fp": 2, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.92, "recall": 0.8519, "f1": 0.8846, "f2": 0.8647, "f2_score": 86.5, "f3": 0.8582, "f3_score": 85.8, "tpr": 0.8519, "fpr": 0.3333, "youden_j": 0.5185, "cvss_coverage": 1.0, "cvss_tp_weight": 149.5, "cvss_fp_weight": 16.0, "cvss_fn_weight": 19.6, "cvss_precision": 0.9033, "cvss_recall": 0.8841, "cvss_f3": 0.886, "cvss_f3_score": 88.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 23, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5208, "recall": 0.9259, "f1": 0.6667, "f2": 0.8013, "f2_score": 80.1, "f3": 0.8591, "f3_score": 85.9, "tpr": 0.9259, "fpr": 0.8519, "youden_j": 0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 160.1, "cvss_fp_weight": 170.5, "cvss_fn_weight": 9.0, "cvss_precision": 0.4843, "cvss_recall": 0.9468, "cvss_f3": 0.8642, "cvss_f3_score": 86.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dsvw-020", "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-021", "file": "dsvw.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dsvw-023", "file": "dsvw.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "dsvw-026", "file": "dsvw.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 15, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8982, "recall": 0.5432, "f1": 0.6749, "f2": 0.589, "f2_score": 58.9, "f3": 0.5651, "f3_score": 56.5, "tpr": 0.5432, "fpr": 0.2889, "youden_j": 0.2543, "cvss_coverage": 1.0, "cvss_tp_weight": 104.5, "cvss_fp_weight": 10.5, "cvss_fn_weight": 64.6, "cvss_precision": 0.9094, "cvss_recall": 0.6182, "cvss_f3": 0.6383, "cvss_f3_score": 63.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 19, "fp": 5, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7917, "recall": 0.7037, "f1": 0.7451, "f2": 0.7197, "f2_score": 72.0, "f3": 0.7116, "f3_score": 71.2, "tpr": 0.7037, "fpr": 0.625, "youden_j": 0.0787, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 31.4, "cvss_fn_weight": 39.0, "cvss_precision": 0.8054, "cvss_recall": 0.7694, "cvss_f3": 0.7728, "cvss_f3_score": 77.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 1, "fn": 1, "precision": 0.75, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 1, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-019", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "dsvw-fp-003", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-022", "file": "dsvw.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 19, "fp": 4, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8261, "recall": 0.7037, "f1": 0.76, "f2": 0.7252, "f2_score": 72.5, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7037, "fpr": 0.5, "youden_j": 0.2037, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 25.1, "cvss_fn_weight": 39.0, "cvss_precision": 0.838, "cvss_recall": 0.7694, "cvss_f3": 0.7757, "cvss_f3_score": 77.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-002", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-011", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-014", "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-004", "file": "dsvw.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dsvw-005", "file": "dsvw.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-008", "file": "dsvw.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dsvw-013", "file": "dsvw.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-009", "file": "dsvw.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dsvw-017", "file": "dsvw.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dsvw-016", "file": "dsvw.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "dsvw-025", "file": "dsvw.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.2963, "f1": 0.4103, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3137, "f3_score": 31.4, "tpr": 0.2963, "fpr": 0.5, "youden_j": -0.2037, "cvss_coverage": 1.0, "cvss_tp_weight": 64.8, "cvss_fp_weight": 11.0, "cvss_fn_weight": 104.3, "cvss_precision": 0.8549, "cvss_recall": 0.3832, "cvss_f3": 0.4056, "cvss_f3_score": 40.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dsvw-007", "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dsvw-003", "file": "dsvw.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dsvw-001", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-006", "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dsvw-010", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dsvw-012", "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-015", "file": "dsvw.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dsvw.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dsvw-018", "file": "dsvw.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvw-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvw-008", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dsvw-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 169.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dsvw-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvw-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvw-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvw-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvw-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dsvw-008", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dsvw-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dsvw-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-012", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "dsvw-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-015", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 169.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dsvw-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dsvw-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dsvw-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dsvw-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dsvw-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dsvw-008", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dsvw-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dsvw-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-012", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "dsvw-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dsvw-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-015", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dsvw-016", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "dsvw-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dsvw-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dsvw-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dsvw-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dsvw-021", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dsvw-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dsvw-023", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dsvw-024", "file": null, "cwe": "CWE-235" }, { "classification": "FN", "ground_truth_id": "dsvw-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dsvw-026", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dsvw-027", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dsvw-fp-004", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-dvblab": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 17, "fp": 6, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.7727, "f1": 0.7556, "f2": 0.7658, "f2_score": 76.6, "f3": 0.7692, "f3_score": 76.9, "tpr": 0.7727, "fpr": 0.6, "youden_j": 0.1727, "cvss_coverage": 1.0, "cvss_tp_weight": 137.5, "cvss_fp_weight": 26.9, "cvss_fn_weight": 31.1, "cvss_precision": 0.8362, "cvss_recall": 0.8155, "cvss_f3": 0.8176, "cvss_f3_score": 81.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-020", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 0, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.6818, "f1": 0.8108, "f2": 0.7282, "f2_score": 72.8, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.6818, "fpr": 0.0, "youden_j": 0.6818, "cvss_coverage": 1.0, "cvss_tp_weight": 123.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 45.1, "cvss_precision": 1.0, "cvss_recall": 0.7325, "cvss_f3": 0.7526, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 6, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7581, "recall": 0.7121, "f1": 0.7242, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7128, "f3_score": 71.3, "tpr": 0.7121, "fpr": 0.5397, "youden_j": 0.1724, "cvss_coverage": 1.0, "cvss_tp_weight": 125.6, "cvss_fp_weight": 30.7, "cvss_fn_weight": 43.0, "cvss_precision": 0.8276, "cvss_recall": 0.7448, "cvss_f3": 0.7491, "cvss_f3_score": 74.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 2, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8785, "recall": 0.6364, "f1": 0.7377, "f2": 0.6733, "f2_score": 67.3, "f3": 0.6543, "f3_score": 65.4, "tpr": 0.6364, "fpr": 0.3, "youden_j": 0.3364, "cvss_coverage": 1.0, "cvss_tp_weight": 113.2, "cvss_fp_weight": 7.0, "cvss_fn_weight": 55.4, "cvss_precision": 0.9415, "cvss_recall": 0.6716, "cvss_f3": 0.6914, "cvss_f3_score": 69.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 2, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.7727, "f1": 0.8293, "f2": 0.7944, "f2_score": 79.4, "f3": 0.7834, "f3_score": 78.3, "tpr": 0.7727, "fpr": 0.3333, "youden_j": 0.4394, "cvss_coverage": 1.0, "cvss_tp_weight": 132.9, "cvss_fp_weight": 7.0, "cvss_fn_weight": 35.7, "cvss_precision": 0.9501, "cvss_recall": 0.7883, "cvss_f3": 0.8019, "cvss_f3_score": 80.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 1, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9583, "recall": 0.6212, "f1": 0.7512, "f2": 0.6671, "f2_score": 66.7, "f3": 0.6433, "f3_score": 64.3, "tpr": 0.6212, "fpr": 0.1111, "youden_j": 0.5101, "cvss_coverage": 1.0, "cvss_tp_weight": 111.8, "cvss_fp_weight": 4.3, "cvss_fn_weight": 56.8, "cvss_precision": 0.9661, "cvss_recall": 0.6631, "cvss_f3": 0.684, "cvss_f3_score": 68.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 0, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4545, "f1": 0.625, "f2": 0.5102, "f2_score": 51.0, "f3": 0.4808, "f3_score": 48.1, "tpr": 0.4545, "fpr": 0.0, "youden_j": 0.4545, "cvss_coverage": 1.0, "cvss_tp_weight": 84.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 84.1, "cvss_precision": 1.0, "cvss_recall": 0.5012, "cvss_f3": 0.5275, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 2, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8603, "recall": 0.5606, "f1": 0.6787, "f2": 0.6025, "f2_score": 60.2, "f3": 0.5808, "f3_score": 58.1, "tpr": 0.5606, "fpr": 0.3333, "youden_j": 0.2273, "cvss_coverage": 1.0, "cvss_tp_weight": 103.5, "cvss_fp_weight": 13.0, "cvss_fn_weight": 65.1, "cvss_precision": 0.8886, "cvss_recall": 0.6141, "cvss_f3": 0.6336, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 4, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7975, "recall": 0.7121, "f1": 0.7489, "f2": 0.7257, "f2_score": 72.6, "f3": 0.7188, "f3_score": 71.9, "tpr": 0.7121, "fpr": 0.4947, "youden_j": 0.2174, "cvss_coverage": 1.0, "cvss_tp_weight": 125.4, "cvss_fp_weight": 14.0, "cvss_fn_weight": 43.2, "cvss_precision": 0.8985, "cvss_recall": 0.744, "cvss_f3": 0.7564, "cvss_f3_score": 75.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 13, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6108, "recall": 0.7879, "f1": 0.6729, "f2": 0.7329, "f2_score": 73.3, "f3": 0.7585, "f3_score": 75.9, "tpr": 0.7879, "fpr": 0.7061, "youden_j": 0.0818, "cvss_coverage": 1.0, "cvss_tp_weight": 137.6, "cvss_fp_weight": 60.2, "cvss_fn_weight": 31.0, "cvss_precision": 0.734, "cvss_recall": 0.8159, "cvss_f3": 0.8002, "cvss_f3_score": 80.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-021", "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 9, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.8182, "f1": 0.7347, "f2": 0.7826, "f2_score": 78.3, "f3": 0.8, "f3_score": 80.0, "tpr": 0.8182, "fpr": 0.6923, "youden_j": 0.1259, "cvss_coverage": 1.0, "cvss_tp_weight": 136.0, "cvss_fp_weight": 22.5, "cvss_fn_weight": 32.6, "cvss_precision": 0.8583, "cvss_recall": 0.8066, "cvss_f3": 0.8115, "cvss_f3_score": 81.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8055, "recall": 0.6818, "f1": 0.7381, "f2": 0.7031, "f2_score": 70.3, "f3": 0.6923, "f3_score": 69.2, "tpr": 0.6818, "fpr": 0.4709, "youden_j": 0.2109, "cvss_coverage": 1.0, "cvss_tp_weight": 121.8, "cvss_fp_weight": 21.8, "cvss_fn_weight": 46.8, "cvss_precision": 0.8488, "cvss_recall": 0.7224, "cvss_f3": 0.7333, "cvss_f3_score": 73.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 0, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5455, "f1": 0.7059, "f2": 0.6, "f2_score": 60.0, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5455, "fpr": 0.0, "youden_j": 0.5455, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 71.8, "cvss_precision": 1.0, "cvss_recall": 0.5741, "cvss_f3": 0.5997, "cvss_f3_score": 60.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 11, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.8636, "f1": 0.7308, "f2": 0.8051, "f2_score": 80.5, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.8636, "fpr": 0.7333, "youden_j": 0.1303, "cvss_coverage": 1.0, "cvss_tp_weight": 145.8, "cvss_fp_weight": 65.3, "cvss_fn_weight": 22.8, "cvss_precision": 0.6905, "cvss_recall": 0.8648, "cvss_f3": 0.8435, "cvss_f3_score": 84.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/config.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 1, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.5909, "f1": 0.7222, "f2": 0.6373, "f2_score": 63.7, "f3": 0.6132, "f3_score": 61.3, "tpr": 0.5909, "fpr": 0.2, "youden_j": 0.3909, "cvss_coverage": 1.0, "cvss_tp_weight": 105.6, "cvss_fp_weight": 6.5, "cvss_fn_weight": 63.0, "cvss_precision": 0.9421, "cvss_recall": 0.6263, "cvss_f3": 0.6481, "cvss_f3_score": 64.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.5455, "f1": 0.6154, "f2": 0.5714, "f2_score": 57.1, "f3": 0.5581, "f3_score": 55.8, "tpr": 0.5455, "fpr": 0.5556, "youden_j": -0.0101, "cvss_coverage": 1.0, "cvss_tp_weight": 95.6, "cvss_fp_weight": 26.4, "cvss_fn_weight": 73.0, "cvss_precision": 0.7834, "cvss_recall": 0.567, "cvss_f3": 0.5831, "cvss_f3_score": 58.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-839" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 8, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.9091, "f1": 0.8, "f2": 0.8621, "f2_score": 86.2, "f3": 0.885, "f3_score": 88.5, "tpr": 0.9091, "fpr": 0.6667, "youden_j": 0.2424, "cvss_coverage": 1.0, "cvss_tp_weight": 152.3, "cvss_fp_weight": 45.9, "cvss_fn_weight": 16.3, "cvss_precision": 0.7684, "cvss_recall": 0.9033, "cvss_f3": 0.8877, "cvss_f3_score": 88.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7434, "recall": 0.5455, "f1": 0.6146, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5561, "f3_score": 55.6, "tpr": 0.5455, "fpr": 0.406, "youden_j": 0.1394, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 17.0, "cvss_fn_weight": 69.2, "cvss_precision": 0.8615, "cvss_recall": 0.5896, "cvss_f3": 0.6085, "cvss_f3_score": 60.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 3, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8505, "recall": 0.697, "f1": 0.7657, "f2": 0.7229, "f2_score": 72.3, "f3": 0.7097, "f3_score": 70.9, "tpr": 0.697, "fpr": 0.3968, "youden_j": 0.3001, "cvss_coverage": 1.0, "cvss_tp_weight": 124.1, "cvss_fp_weight": 11.3, "cvss_fn_weight": 44.5, "cvss_precision": 0.9173, "cvss_recall": 0.7361, "cvss_f3": 0.7506, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 3, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8241, "recall": 0.697, "f1": 0.7548, "f2": 0.7189, "f2_score": 71.9, "f3": 0.7077, "f3_score": 70.8, "tpr": 0.697, "fpr": 0.4392, "youden_j": 0.2578, "cvss_coverage": 1.0, "cvss_tp_weight": 125.8, "cvss_fp_weight": 13.7, "cvss_fn_weight": 42.8, "cvss_precision": 0.905, "cvss_recall": 0.7462, "cvss_f3": 0.7593, "cvss_f3_score": 75.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-021", "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 15, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.6818, "f1": 0.7317, "f2": 0.7009, "f2_score": 70.1, "f3": 0.6912, "f3_score": 69.1, "tpr": 0.6818, "fpr": 0.5, "youden_j": 0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 122.2, "cvss_fp_weight": 8.0, "cvss_fn_weight": 46.4, "cvss_precision": 0.9387, "cvss_recall": 0.7248, "cvss_f3": 0.7417, "cvss_f3_score": 74.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-1284" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 9, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.5455, "f1": 0.5581, "f2": 0.5505, "f2_score": 55.0, "f3": 0.5479, "f3_score": 54.8, "tpr": 0.5455, "fpr": 0.6923, "youden_j": -0.1469, "cvss_coverage": 1.0, "cvss_tp_weight": 97.5, "cvss_fp_weight": 67.5, "cvss_fn_weight": 71.1, "cvss_precision": 0.5909, "cvss_recall": 0.5783, "cvss_f3": 0.5795, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/PasswordUpdate.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransactionList.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 19, "fp": 42, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3115, "recall": 0.8636, "f1": 0.4578, "f2": 0.6376, "f2_score": 63.8, "f3": 0.7336, "f3_score": 73.4, "tpr": 0.8636, "fpr": 0.913, "youden_j": -0.0494, "cvss_coverage": 1.0, "cvss_tp_weight": 150.2, "cvss_fp_weight": 285.5, "cvss_fn_weight": 18.4, "cvss_precision": 0.3447, "cvss_recall": 0.8909, "cvss_f3": 0.769, "cvss_f3_score": 76.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "dvblab-020", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 15, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.9091, "f1": 0.7018, "f2": 0.813, "f2_score": 81.3, "f3": 0.8584, "f3_score": 85.8, "tpr": 0.9091, "fpr": 0.7895, "youden_j": 0.1196, "cvss_coverage": 1.0, "cvss_tp_weight": 153.9, "cvss_fp_weight": 86.5, "cvss_fn_weight": 14.7, "cvss_precision": 0.6402, "cvss_recall": 0.9128, "cvss_f3": 0.8755, "cvss_f3_score": 87.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvblab-020", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 7, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.3182, "f1": 0.4516, "f2": 0.3608, "f2_score": 36.1, "f3": 0.3382, "f3_score": 33.8, "tpr": 0.3182, "fpr": 0.3333, "youden_j": -0.0152, "cvss_coverage": 1.0, "cvss_tp_weight": 59.4, "cvss_fp_weight": 17.5, "cvss_fn_weight": 109.2, "cvss_precision": 0.7724, "cvss_recall": 0.3523, "cvss_f3": 0.3726, "cvss_f3_score": 37.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransactionList.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransactionList.js", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-012", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 20, "fp": 31, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3922, "recall": 0.9091, "f1": 0.5479, "f2": 0.7194, "f2_score": 71.9, "f3": 0.8032, "f3_score": 80.3, "tpr": 0.9091, "fpr": 0.8857, "youden_j": 0.0234, "cvss_coverage": 1.0, "cvss_tp_weight": 156.1, "cvss_fp_weight": 228.5, "cvss_fn_weight": 12.5, "cvss_precision": 0.4059, "cvss_recall": 0.9259, "cvss_f3": 0.8207, "cvss_f3_score": 82.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-662" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-020", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/Dockerfile", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 12, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6129, "recall": 0.8636, "f1": 0.717, "f2": 0.7983, "f2_score": 79.8, "f3": 0.8297, "f3_score": 83.0, "tpr": 0.8636, "fpr": 0.75, "youden_j": 0.1136, "cvss_coverage": 1.0, "cvss_tp_weight": 144.2, "cvss_fp_weight": 91.0, "cvss_fn_weight": 24.4, "cvss_precision": 0.6131, "cvss_recall": 0.8553, "cvss_f3": 0.8228, "cvss_f3_score": 82.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 14, "fp": 20, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4118, "recall": 0.6364, "f1": 0.5, "f2": 0.5738, "f2_score": 57.4, "f3": 0.6034, "f3_score": 60.3, "tpr": 0.6364, "fpr": 0.8696, "youden_j": -0.2332, "cvss_coverage": 1.0, "cvss_tp_weight": 107.3, "cvss_fp_weight": 150.5, "cvss_fn_weight": 61.3, "cvss_precision": 0.4162, "cvss_recall": 0.6364, "cvss_f3": 0.6044, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 1, "fn": 0, "precision": 0.8, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "high": { "tp": 7, "fp": 1, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "dvblab-fp-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-012", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 42, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.9545, "f1": 0.4941, "f2": 0.6954, "f2_score": 69.5, "f3": 0.8046, "f3_score": 80.5, "tpr": 0.9545, "fpr": 0.913, "youden_j": 0.0415, "cvss_coverage": 1.0, "cvss_tp_weight": 159.8, "cvss_fp_weight": 298.0, "cvss_fn_weight": 8.8, "cvss_precision": 0.3491, "cvss_recall": 0.9478, "cvss_f3": 0.809, "cvss_f3_score": 80.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-662" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvblab-006", "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dvblab-017", "file": "backend/routes/auth_routes.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvblab-018", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "dvblab-019", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-011", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-020", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/Dockerfile", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 12, "fp": 2, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8899, "recall": 0.5303, "f1": 0.6586, "f2": 0.5745, "f2_score": 57.4, "f3": 0.5514, "f3_score": 55.1, "tpr": 0.5303, "fpr": 0.254, "youden_j": 0.2763, "cvss_coverage": 1.0, "cvss_tp_weight": 94.1, "cvss_fp_weight": 10.8, "cvss_fn_weight": 74.5, "cvss_precision": 0.9089, "cvss_recall": 0.5579, "cvss_f3": 0.5791, "cvss_f3_score": 57.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvblab-021", "file": "backend/routes/auth_routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-007", "file": "backend/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvblab-016", "file": "backend/routes/auth_routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 7, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.3182, "f1": 0.4375, "f2": 0.3571, "f2_score": 35.7, "f3": 0.3365, "f3_score": 33.7, "tpr": 0.3182, "fpr": 0.4286, "youden_j": -0.1104, "cvss_coverage": 1.0, "cvss_tp_weight": 58.4, "cvss_fp_weight": 19.5, "cvss_fn_weight": 110.2, "cvss_precision": 0.7501, "cvss_recall": 0.3464, "cvss_f3": 0.3661, "cvss_f3_score": 36.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5882, "recall": 0.4545, "f1": 0.5128, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4651, "f3_score": 46.5, "tpr": 0.4545, "fpr": 0.6364, "youden_j": -0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 80.6, "cvss_fp_weight": 45.4, "cvss_fn_weight": 88.0, "cvss_precision": 0.6397, "cvss_recall": 0.4781, "cvss_f3": 0.4904, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-005", "file": "backend/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-014", "file": "backend/app.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvblab-015", "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvblab-010", "file": "backend/routes/auth_routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 17, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2917, "recall": 0.3182, "f1": 0.3043, "f2": 0.3125, "f2_score": 31.2, "f3": 0.3153, "f3_score": 31.5, "tpr": 0.3182, "fpr": 0.8095, "youden_j": -0.4913, "cvss_coverage": 1.0, "cvss_tp_weight": 52.8, "cvss_fp_weight": 23.5, "cvss_fn_weight": 115.8, "cvss_precision": 0.692, "cvss_recall": 0.3132, "cvss_f3": 0.3313, "cvss_f3_score": 33.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvblab-022", "file": "backend/routes/auth_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/PasswordUpdate.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransactionList.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransactionList.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/TransferForm.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvblab-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "semgrep": { "scanner": "semgrep", "tp": 8, "fp": 22, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.3636, "f1": 0.3077, "f2": 0.339, "f2_score": 33.9, "f3": 0.3509, "f3_score": 35.1, "tpr": 0.3636, "fpr": 0.88, "youden_j": -0.5164, "cvss_coverage": 1.0, "cvss_tp_weight": 65.9, "cvss_fp_weight": 142.7, "cvss_fn_weight": 102.7, "cvss_precision": 0.316, "cvss_recall": 0.3909, "cvss_f3": 0.3818, "cvss_f3_score": 38.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 1, "fn": 0, "precision": 0.8, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "high": { "tp": 4, "fp": 1, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "dvblab-013", "file": "backend/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvblab-008", "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/models.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvblab-009", "file": "backend/routes/auth_routes.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "dvblab-002", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "dvblab-fp-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "dvblab-001", "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvblab-012", "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/auth_routes.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvblab-004", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvblab-003", "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/routes/transaction_routes.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 168.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dvblab-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvblab-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-008", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-009", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvblab-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvblab-012", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dvblab-013", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvblab-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "dvblab-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvblab-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvblab-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvblab-018", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "dvblab-019", "file": null, "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "dvblab-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvblab-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvblab-022", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvblab-fp-004", "file": null, "cwe": "CWE-502" } ] } }, "realvuln-dvna": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 4, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.5294, "f1": 0.6, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5422, "f3_score": 54.2, "tpr": 0.5294, "fpr": 1.0, "youden_j": -0.4706, "cvss_coverage": 1.0, "cvss_tp_weight": 61.2, "cvss_fp_weight": 20.6, "cvss_fn_weight": 52.9, "cvss_precision": 0.7478, "cvss_recall": 0.5364, "cvss_f3": 0.552, "cvss_f3_score": 55.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvna-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvna-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvna-015", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 11, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.6471, "f1": 0.5641, "f2": 0.6111, "f2_score": 61.1, "f3": 0.6286, "f3_score": 62.9, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 74.4, "cvss_fp_weight": 73.8, "cvss_fn_weight": 39.7, "cvss_precision": 0.5019, "cvss_recall": 0.6521, "cvss_f3": 0.6331, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/app.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "dvna-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 5, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.6471, "f1": 0.6667, "f2": 0.6548, "f2_score": 65.5, "f3": 0.6509, "f3_score": 65.1, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 74.4, "cvss_fp_weight": 27.3, "cvss_fn_weight": 39.7, "cvss_precision": 0.7312, "cvss_recall": 0.6521, "cvss_f3": 0.6592, "cvss_f3_score": 65.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 11, "fp": 8, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.6471, "f1": 0.6111, "f2": 0.6322, "f2_score": 63.2, "f3": 0.6395, "f3_score": 64.0, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 74.4, "cvss_fp_weight": 41.3, "cvss_fn_weight": 39.7, "cvss_precision": 0.6432, "cvss_recall": 0.6521, "cvss_f3": 0.6512, "cvss_f3_score": 65.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvna-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 12, "fp": 8, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.7059, "f1": 0.6486, "f2": 0.6818, "f2_score": 68.2, "f3": 0.6936, "f3_score": 69.4, "tpr": 0.7059, "fpr": 1.0, "youden_j": -0.2941, "cvss_coverage": 1.0, "cvss_tp_weight": 79.7, "cvss_fp_weight": 35.1, "cvss_fn_weight": 34.4, "cvss_precision": 0.6945, "cvss_recall": 0.6985, "cvss_f3": 0.6981, "cvss_f3_score": 69.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvna-007", "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 15, "fp": 8, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6522, "recall": 0.8824, "f1": 0.75, "f2": 0.8242, "f2_score": 82.4, "f3": 0.8523, "f3_score": 85.2, "tpr": 0.8824, "fpr": 1.0, "youden_j": -0.1176, "cvss_coverage": 1.0, "cvss_tp_weight": 100.1, "cvss_fp_weight": 47.5, "cvss_fn_weight": 14.0, "cvss_precision": 0.6783, "cvss_recall": 0.8773, "cvss_f3": 0.8523, "cvss_f3_score": 85.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 1, "recall": 0.9375 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvna-013", "file": "server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvna-007", "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvna-012", "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvna-009", "file": "core/passport.js", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 11, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5217, "recall": 0.7059, "f1": 0.6, "f2": 0.6593, "f2_score": 65.9, "f3": 0.6818, "f3_score": 68.2, "tpr": 0.7059, "fpr": 1.0, "youden_j": -0.2941, "cvss_coverage": 1.0, "cvss_tp_weight": 85.2, "cvss_fp_weight": 73.8, "cvss_fn_weight": 28.9, "cvss_precision": 0.5357, "cvss_recall": 0.7467, "cvss_f3": 0.7184, "cvss_f3_score": 71.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-013", "file": "server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvna-007", "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvna-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 17, "fp": 13, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5667, "recall": 1.0, "f1": 0.7234, "f2": 0.8673, "f2_score": 86.7, "f3": 0.929, "f3_score": 92.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 114.1, "cvss_fp_weight": 74.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.6039, "cvss_recall": 1.0, "cvss_f3": 0.9385, "cvss_f3_score": 93.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-007", "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvna-008", "file": "core/authHandler.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvna-009", "file": "core/passport.js", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "dvna-010", "file": "routes/app.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvna-011", "file": "routes/main.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-012", "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "dvna-013", "file": "server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 15, "fp": 13, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.8824, "f1": 0.6667, "f2": 0.7812, "f2_score": 78.1, "f3": 0.8287, "f3_score": 82.9, "tpr": 0.8824, "fpr": 1.0, "youden_j": -0.1176, "cvss_coverage": 1.0, "cvss_tp_weight": 102.3, "cvss_fp_weight": 96.5, "cvss_fn_weight": 11.8, "cvss_precision": 0.5146, "cvss_recall": 0.8966, "cvss_f3": 0.8346, "cvss_f3_score": 83.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-003", "file": "core/appHandler.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvna-007", "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/passport.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/main.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-011", "file": "routes/main.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvna-012", "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/main.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvna-015", "file": "views/app/adminusers.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/common/footer.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/authHandler.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvna-008", "file": "core/authHandler.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "dvna-014", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvna-013", "file": "server.js", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-010", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 20, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2593, "recall": 0.4118, "f1": 0.3182, "f2": 0.3684, "f2_score": 36.8, "f3": 0.3889, "f3_score": 38.9, "tpr": 0.4118, "fpr": 1.0, "youden_j": -0.5882, "cvss_coverage": 1.0, "cvss_tp_weight": 47.3, "cvss_fp_weight": 128.0, "cvss_fn_weight": 66.8, "cvss_precision": 0.2698, "cvss_recall": 0.4145, "cvss_f3": 0.3934, "cvss_f3_score": 39.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "config/db.js", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dvna-001", "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvna-002", "file": "core/appHandler.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvna-004", "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/appHandler.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvna-005", "file": "core/appHandler.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvna-006", "file": "core/appHandler.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvna-016", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvna-017", "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/app/products.ejs", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvna-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvna-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvna-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "dvna-009", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "dvna-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvna-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvna-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvna-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvna-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvna-015", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": null }, "realvuln-dvpwa": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 12, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.5217, "f1": 0.5455, "f2": 0.531, "f2_score": 53.1, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5217, "fpr": 0.6923, "youden_j": -0.1706, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 33.4, "cvss_fn_weight": 55.5, "cvss_precision": 0.6755, "cvss_recall": 0.5564, "cvss_f3": 0.5663, "cvss_f3_score": 56.6, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 2, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.4348, "f1": 0.5714, "f2": 0.4808, "f2_score": 48.1, "f3": 0.4566, "f3_score": 45.7, "tpr": 0.4348, "fpr": 0.3333, "youden_j": 0.1014, "cvss_coverage": 1.0, "cvss_tp_weight": 57.0, "cvss_fp_weight": 5.1, "cvss_fn_weight": 68.1, "cvss_precision": 0.9174, "cvss_recall": 0.4556, "cvss_f3": 0.4798, "cvss_f3_score": 48.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8392, "recall": 0.4348, "f1": 0.5524, "f2": 0.4733, "f2_score": 47.4, "f3": 0.453, "f3_score": 45.3, "tpr": 0.4348, "fpr": 0.3111, "youden_j": 0.1236, "cvss_coverage": 1.0, "cvss_tp_weight": 57.4, "cvss_fp_weight": 11.0, "cvss_fn_weight": 67.7, "cvss_precision": 0.8831, "cvss_recall": 0.4588, "cvss_f3": 0.4781, "cvss_f3_score": 47.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 9, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7056, "recall": 0.4058, "f1": 0.508, "f2": 0.4404, "f2_score": 44.0, "f3": 0.4223, "f3_score": 42.2, "tpr": 0.4058, "fpr": 0.4857, "youden_j": -0.0799, "cvss_coverage": 1.0, "cvss_tp_weight": 51.5, "cvss_fp_weight": 13.0, "cvss_fn_weight": 73.6, "cvss_precision": 0.8012, "cvss_recall": 0.4114, "cvss_f3": 0.4308, "cvss_f3_score": 43.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 7, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.6957, "f1": 0.6957, "f2": 0.6957, "f2_score": 69.6, "f3": 0.6957, "f3_score": 69.6, "tpr": 0.6957, "fpr": 0.6364, "youden_j": 0.0593, "cvss_coverage": 1.0, "cvss_tp_weight": 95.6, "cvss_fp_weight": 24.2, "cvss_fn_weight": 29.5, "cvss_precision": 0.7982, "cvss_recall": 0.7642, "cvss_f3": 0.7675, "cvss_f3_score": 76.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/base.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8472, "recall": 0.2464, "f1": 0.3804, "f2": 0.2867, "f2_score": 28.7, "f3": 0.265, "f3_score": 26.5, "tpr": 0.2464, "fpr": 0.2, "youden_j": 0.0464, "cvss_coverage": 1.0, "cvss_tp_weight": 30.4, "cvss_fp_weight": 3.2, "cvss_fn_weight": 94.7, "cvss_precision": 0.9083, "cvss_recall": 0.2433, "cvss_f3": 0.2622, "cvss_f3_score": 26.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 5, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2174, "f1": 0.3571, "f2": 0.2577, "f2_score": 25.8, "f3": 0.2358, "f3_score": 23.6, "tpr": 0.2174, "fpr": 0.0, "youden_j": 0.2174, "cvss_coverage": 1.0, "cvss_tp_weight": 28.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 96.6, "cvss_precision": 1.0, "cvss_recall": 0.2278, "cvss_f3": 0.2469, "cvss_f3_score": 24.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 8, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5716, "recall": 0.3478, "f1": 0.4294, "f2": 0.3761, "f2_score": 37.6, "f3": 0.3614, "f3_score": 36.1, "tpr": 0.3478, "fpr": 0.59, "youden_j": -0.2421, "cvss_coverage": 1.0, "cvss_tp_weight": 44.8, "cvss_fp_weight": 25.2, "cvss_fn_weight": 80.3, "cvss_precision": 0.6501, "cvss_recall": 0.3581, "cvss_f3": 0.3742, "cvss_f3_score": 37.4, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 14, "fp": 8, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6553, "recall": 0.6087, "f1": 0.6276, "f2": 0.6153, "f2_score": 61.5, "f3": 0.6119, "f3_score": 61.2, "tpr": 0.6087, "fpr": 0.6592, "youden_j": -0.0505, "cvss_coverage": 1.0, "cvss_tp_weight": 80.6, "cvss_fp_weight": 32.8, "cvss_fn_weight": 44.5, "cvss_precision": 0.7222, "cvss_recall": 0.6443, "cvss_f3": 0.6499, "cvss_f3_score": 65.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 1, "fn": 0, "precision": 0.8571, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 10, "fp": 1, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "dvpwa-fp-004", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 10, "fp": 9, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5536, "recall": 0.4493, "f1": 0.4889, "f2": 0.4633, "f2_score": 46.3, "f3": 0.456, "f3_score": 45.6, "tpr": 0.4493, "fpr": 0.6677, "youden_j": -0.2184, "cvss_coverage": 1.0, "cvss_tp_weight": 58.5, "cvss_fp_weight": 30.5, "cvss_fn_weight": 66.6, "cvss_precision": 0.6619, "cvss_recall": 0.4679, "cvss_f3": 0.4804, "cvss_f3_score": 48.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.5652, "f1": 0.619, "f2": 0.5856, "f2_score": 58.6, "f3": 0.5752, "f3_score": 57.5, "tpr": 0.5652, "fpr": 0.6, "youden_j": -0.0348, "cvss_coverage": 1.0, "cvss_tp_weight": 74.1, "cvss_fp_weight": 11.3, "cvss_fn_weight": 51.0, "cvss_precision": 0.868, "cvss_recall": 0.5923, "cvss_f3": 0.6118, "cvss_f3_score": 61.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 13, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7425, "recall": 0.5797, "f1": 0.6419, "f2": 0.6015, "f2_score": 60.2, "f3": 0.5902, "f3_score": 59.0, "tpr": 0.5797, "fpr": 0.5357, "youden_j": 0.044, "cvss_coverage": 1.0, "cvss_tp_weight": 77.0, "cvss_fp_weight": 17.7, "cvss_fn_weight": 48.1, "cvss_precision": 0.8359, "cvss_recall": 0.6157, "cvss_f3": 0.6292, "cvss_f3_score": 62.9, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 6, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.2609, "f1": 0.3636, "f2": 0.2941, "f2_score": 29.4, "f3": 0.2765, "f3_score": 27.6, "tpr": 0.2609, "fpr": 0.5, "youden_j": -0.2391, "cvss_coverage": 1.0, "cvss_tp_weight": 33.8, "cvss_fp_weight": 18.5, "cvss_fn_weight": 91.3, "cvss_precision": 0.6459, "cvss_recall": 0.2702, "cvss_f3": 0.2869, "cvss_f3_score": 28.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-008", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 11, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.4783, "f1": 0.5641, "f2": 0.5093, "f2_score": 50.9, "f3": 0.4933, "f3_score": 49.3, "tpr": 0.4783, "fpr": 0.5556, "youden_j": -0.0773, "cvss_coverage": 1.0, "cvss_tp_weight": 66.6, "cvss_fp_weight": 14.9, "cvss_fn_weight": 58.5, "cvss_precision": 0.8172, "cvss_recall": 0.5324, "cvss_f3": 0.5516, "cvss_f3_score": 55.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 6, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5217, "f1": 0.5854, "f2": 0.5455, "f2_score": 54.5, "f3": 0.5333, "f3_score": 53.3, "tpr": 0.5217, "fpr": 0.6, "youden_j": -0.0783, "cvss_coverage": 1.0, "cvss_tp_weight": 67.9, "cvss_fp_weight": 23.7, "cvss_fn_weight": 57.2, "cvss_precision": 0.7415, "cvss_recall": 0.5428, "cvss_f3": 0.5577, "cvss_f3_score": 55.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 8, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.4783, "f1": 0.5238, "f2": 0.4955, "f2_score": 49.5, "f3": 0.4867, "f3_score": 48.7, "tpr": 0.4783, "fpr": 0.6667, "youden_j": -0.1884, "cvss_coverage": 1.0, "cvss_tp_weight": 66.6, "cvss_fp_weight": 24.7, "cvss_fn_weight": 58.5, "cvss_precision": 0.7297, "cvss_recall": 0.5324, "cvss_f3": 0.5472, "cvss_f3_score": 54.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 16, "fp": 5, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.6957, "f1": 0.7273, "f2": 0.708, "f2_score": 70.8, "f3": 0.7018, "f3_score": 70.2, "tpr": 0.6957, "fpr": 0.5556, "youden_j": 0.1401, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 23.2, "cvss_fn_weight": 28.3, "cvss_precision": 0.8069, "cvss_recall": 0.7738, "cvss_f3": 0.777, "cvss_f3_score": 77.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 9, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.58, "recall": 0.4928, "f1": 0.5246, "f2": 0.5032, "f2_score": 50.3, "f3": 0.4976, "f3_score": 49.7, "tpr": 0.4928, "fpr": 0.6982, "youden_j": -0.2055, "cvss_coverage": 1.0, "cvss_tp_weight": 64.5, "cvss_fp_weight": 37.6, "cvss_fn_weight": 60.6, "cvss_precision": 0.6485, "cvss_recall": 0.5153, "cvss_f3": 0.5241, "cvss_f3_score": 52.4, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "dvpwa-fp-003", "file": "sqli/dao/course.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6499, "recall": 0.5652, "f1": 0.6006, "f2": 0.5782, "f2_score": 57.8, "f3": 0.5715, "f3_score": 57.2, "tpr": 0.5652, "fpr": 0.6282, "youden_j": -0.063, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 29.9, "cvss_fn_weight": 50.6, "cvss_precision": 0.7241, "cvss_recall": 0.5953, "cvss_f3": 0.605, "cvss_f3_score": 60.5, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 10, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5893, "recall": 0.5797, "f1": 0.5814, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5796, "f3_score": 57.9, "tpr": 0.5797, "fpr": 0.7089, "youden_j": -0.1292, "cvss_coverage": 1.0, "cvss_tp_weight": 76.4, "cvss_fp_weight": 37.9, "cvss_fn_weight": 48.7, "cvss_precision": 0.6808, "cvss_recall": 0.6104, "cvss_f3": 0.6156, "cvss_f3_score": 61.6, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 8, "fp": 5, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.3478, "f1": 0.4444, "f2": 0.381, "f2_score": 38.1, "f3": 0.3636, "f3_score": 36.4, "tpr": 0.3478, "fpr": 0.5556, "youden_j": -0.2077, "cvss_coverage": 1.0, "cvss_tp_weight": 42.8, "cvss_fp_weight": 14.9, "cvss_fn_weight": 82.3, "cvss_precision": 0.7418, "cvss_recall": 0.3421, "cvss_f3": 0.3616, "cvss_f3_score": 36.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 7, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.3043, "f1": 0.4, "f2": 0.3365, "f2_score": 33.7, "f3": 0.3196, "f3_score": 32.0, "tpr": 0.3043, "fpr": 0.5556, "youden_j": -0.2512, "cvss_coverage": 1.0, "cvss_tp_weight": 37.5, "cvss_fp_weight": 33.0, "cvss_fn_weight": 87.6, "cvss_precision": 0.5319, "cvss_recall": 0.2998, "cvss_f3": 0.3134, "cvss_f3_score": 31.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 18, "fp": 41, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3051, "recall": 0.7826, "f1": 0.439, "f2": 0.596, "f2_score": 59.6, "f3": 0.6767, "f3_score": 67.7, "tpr": 0.7826, "fpr": 0.9111, "youden_j": -0.1285, "cvss_coverage": 1.0, "cvss_tp_weight": 105.7, "cvss_fp_weight": 279.5, "cvss_fn_weight": 19.4, "cvss_precision": 0.2744, "cvss_recall": 0.8449, "cvss_f3": 0.6995, "cvss_f3_score": 69.9, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/base.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-019", "file": "sqli/utils/jinja2.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/services/redis.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile.app", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "README.rst", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/student.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/review.jinja2", "cwe": "CWE-755" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/utils/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "dvpwa-018", "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/000-init-schema.sql", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 15, "fp": 21, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.6522, "f1": 0.5085, "f2": 0.5859, "f2_score": 58.6, "f3": 0.6173, "f3_score": 61.7, "tpr": 0.6522, "fpr": 0.84, "youden_j": -0.1878, "cvss_coverage": 1.0, "cvss_tp_weight": 89.1, "cvss_fp_weight": 127.5, "cvss_fn_weight": 36.0, "cvss_precision": 0.4114, "cvss_recall": 0.7122, "cvss_f3": 0.6637, "cvss_f3_score": 66.4, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-011", "file": "sqli/templates/errors/50x.jinja2", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-755" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/review.jinja2", "cwe": "CWE-755" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/evaluate.jinja2", "cwe": "CWE-755" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "migrations/001-fixtures.sql", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/student.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/course.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/mark.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/review.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvpwa-018", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.1739, "f1": 0.25, "f2": 0.198, "f2_score": 19.8, "f3": 0.1852, "f3_score": 18.5, "tpr": 0.1739, "fpr": 0.5556, "youden_j": -0.3816, "cvss_coverage": 1.0, "cvss_tp_weight": 24.8, "cvss_fp_weight": 43.0, "cvss_fn_weight": 100.3, "cvss_precision": 0.3658, "cvss_recall": 0.1982, "cvss_f3": 0.2078, "cvss_f3_score": 20.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-008", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 13, "fp": 27, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.325, "recall": 0.5652, "f1": 0.4127, "f2": 0.4924, "f2_score": 49.2, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5652, "fpr": 0.871, "youden_j": -0.3058, "cvss_coverage": 1.0, "cvss_tp_weight": 68.2, "cvss_fp_weight": 196.5, "cvss_fn_weight": 56.9, "cvss_precision": 0.2577, "cvss_recall": 0.5452, "cvss_f3": 0.4904, "cvss_f3_score": 49.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-016", "file": "sqli/schema/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/schema/config.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-020", "file": "sqli/services/db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/services/redis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-019", "file": "sqli/utils/jinja2.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 6, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.8261, "f1": 0.7917, "f2": 0.812, "f2_score": 81.2, "f3": 0.819, "f3_score": 81.9, "tpr": 0.8261, "fpr": 0.6, "youden_j": 0.2261, "cvss_coverage": 1.0, "cvss_tp_weight": 100.3, "cvss_fp_weight": 43.0, "cvss_fn_weight": 24.8, "cvss_precision": 0.6999, "cvss_recall": 0.8018, "cvss_f3": 0.7903, "cvss_f3_score": 79.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-006", "file": "sqli/templates/student.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dvpwa-016", "file": "sqli/schema/config.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-020", "file": "sqli/services/db.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvpwa-021", "file": "sqli/services/db.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dvpwa-022", "file": "sqli/static/js/jquery-3.2.1.min.js", "cwe": "CWE-1395" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-019", "file": "sqli/utils/jinja2.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-018", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 8, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.3478, "f1": 0.4211, "f2": 0.3738, "f2_score": 37.4, "f3": 0.3604, "f3_score": 36.0, "tpr": 0.3478, "fpr": 0.6364, "youden_j": -0.2885, "cvss_coverage": 1.0, "cvss_tp_weight": 47.1, "cvss_fp_weight": 51.0, "cvss_fn_weight": 78.0, "cvss_precision": 0.4801, "cvss_recall": 0.3765, "cvss_f3": 0.3848, "cvss_f3_score": 38.5, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 15, "fp": 32, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3191, "recall": 0.6522, "f1": 0.4286, "f2": 0.5396, "f2_score": 54.0, "f3": 0.5906, "f3_score": 59.1, "tpr": 0.6522, "fpr": 0.8889, "youden_j": -0.2367, "cvss_coverage": 1.0, "cvss_tp_weight": 76.6, "cvss_fp_weight": 224.0, "cvss_fn_weight": 48.5, "cvss_precision": 0.2548, "cvss_recall": 0.6123, "cvss_f3": 0.537, "cvss_f3_score": 53.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvpwa-016", "file": "sqli/schema/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/schema/config.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-020", "file": "sqli/services/db.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvpwa-021", "file": "sqli/services/db.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/services/redis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/services/redis.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "dvpwa-019", "file": "sqli/utils/jinja2.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvpwa-017", "file": "sqli/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-018", "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 6, "fp": 3, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7675, "recall": 0.2609, "f1": 0.3547, "f2": 0.2897, "f2_score": 29.0, "f3": 0.2743, "f3_score": 27.4, "tpr": 0.2609, "fpr": 0.3232, "youden_j": -0.0624, "cvss_coverage": 1.0, "cvss_tp_weight": 35.8, "cvss_fp_weight": 13.9, "cvss_fn_weight": 89.3, "cvss_precision": 0.7988, "cvss_recall": 0.2859, "cvss_f3": 0.3004, "cvss_f3_score": 30.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-003", "file": "sqli/templates/students.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 9, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.3913, "f1": 0.5, "f2": 0.4286, "f2_score": 42.9, "f3": 0.4091, "f3_score": 40.9, "tpr": 0.3913, "fpr": 0.5, "youden_j": -0.1087, "cvss_coverage": 1.0, "cvss_tp_weight": 52.1, "cvss_fp_weight": 18.5, "cvss_fn_weight": 73.0, "cvss_precision": 0.7376, "cvss_recall": 0.4165, "cvss_f3": 0.4354, "cvss_f3_score": 43.5, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-007", "file": "sqli/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-009", "file": "sqli/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvpwa-012", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-023", "file": "sqli/templates/review.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvpwa-013", "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvpwa-015", "file": "sqli/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 6, "fp": 7, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.2609, "f1": 0.3333, "f2": 0.2857, "f2_score": 28.6, "f3": 0.2727, "f3_score": 27.3, "tpr": 0.2609, "fpr": 0.7, "youden_j": -0.4391, "cvss_coverage": 1.0, "cvss_tp_weight": 36.7, "cvss_fp_weight": 28.3, "cvss_fn_weight": 88.4, "cvss_precision": 0.5646, "cvss_recall": 0.2934, "cvss_f3": 0.3082, "cvss_f3_score": 30.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 1, "fn": 2, "recall": 0.0 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-002", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-005", "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/courses.jinja2", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvpwa-004", "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/templates/course.jinja2", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-354" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/dev.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/routes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": "dvpwa-fp-003", "file": "sqli/dao/course.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "rowan": { "scanner": "rowan", "tp": 3, "fp": 14, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1765, "recall": 0.1304, "f1": 0.15, "f2": 0.1376, "f2_score": 13.8, "f3": 0.1339, "f3_score": 13.4, "tpr": 0.1304, "fpr": 0.7778, "youden_j": -0.6473, "cvss_coverage": 1.0, "cvss_tp_weight": 14.2, "cvss_fp_weight": 36.5, "cvss_fn_weight": 110.9, "cvss_precision": 0.2801, "cvss_recall": 0.1135, "cvss_f3": 0.1207, "cvss_f3_score": 12.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "dvpwa-010", "file": "sqli/middlewares.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/utils/jinja2.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "dvpwa-014", "file": "sqli/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/jquery-3.2.1.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.min.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/middlewares.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.min.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.min.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 8, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.087, "f1": 0.1212, "f2": 0.098, "f2_score": 9.8, "f3": 0.0922, "f3_score": 9.2, "tpr": 0.087, "fpr": 0.6667, "youden_j": -0.5797, "cvss_coverage": 1.0, "cvss_tp_weight": 13.5, "cvss_fp_weight": 24.7, "cvss_fn_weight": 111.6, "cvss_precision": 0.3537, "cvss_recall": 0.1079, "cvss_f3": 0.116, "cvss_f3_score": 11.6, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "dvpwa-001", "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/dao/student.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvpwa-008", "file": "sqli/dao/user.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli/static/js/materialize.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 125.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dvpwa-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvpwa-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "dvpwa-008", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "dvpwa-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvpwa-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "dvpwa-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvpwa-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-013", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvpwa-014", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "dvpwa-015", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "dvpwa-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvpwa-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvpwa-017", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvpwa-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-020", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "dvpwa-021", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "dvpwa-022", "file": null, "cwe": "CWE-1395" }, { "classification": "FN", "ground_truth_id": "dvpwa-023", "file": null, "cwe": "CWE-79" } ] } }, "realvuln-dvws-node": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 24, "fp": 22, "fn": 53, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5217, "recall": 0.3117, "f1": 0.3902, "f2": 0.339, "f2_score": 33.9, "f3": 0.3248, "f3_score": 32.5, "tpr": 0.3117, "fpr": 1.0, "youden_j": -0.6883, "cvss_coverage": 1.0, "cvss_tp_weight": 168.1, "cvss_fp_weight": 130.8, "cvss_fn_weight": 309.5, "cvss_precision": 0.5625, "cvss_recall": 0.352, "cvss_f3": 0.3657, "cvss_f3_score": 36.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 30, "recall": 0.434 }, "low": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-013", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-014", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "utils.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvws-node-027", "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-056", "file": "graphql/schema.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvws-node-053", "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-054", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-055", "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvws-node-036", "file": "controllers/users.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-039", "file": "controllers/users.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvws-node-038", "file": "controllers/users.js", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-061", "file": "public/static/userdisplay.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-057", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-058", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-059", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-067", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-068", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-076", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 0, "fp": 0, "fn": 77, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 477.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 53, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-007", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-016", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-019", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-021", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvws-node-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-023", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-026", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dvws-node-027", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-035", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dvws-node-036", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-039", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-053", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-055", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-056", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-057", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-058", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-059", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-060", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-067", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-068", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-069", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-071", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-076", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 77, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 477.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 53, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-007", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-016", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-019", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-021", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvws-node-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-023", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-026", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "dvws-node-027", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-035", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "dvws-node-036", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-039", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-053", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-055", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-056", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-057", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-058", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-059", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-060", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-067", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-068", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-069", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-071", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-076", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 20, "fn": 53, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.3117, "f1": 0.3967, "f2": 0.3409, "f2_score": 34.1, "f3": 0.3256, "f3_score": 32.6, "tpr": 0.3117, "fpr": 1.0, "youden_j": -0.6883, "cvss_coverage": 1.0, "cvss_tp_weight": 170.8, "cvss_fp_weight": 118.3, "cvss_fn_weight": 306.8, "cvss_precision": 0.5907, "cvss_recall": 0.3576, "cvss_f3": 0.3723, "cvss_f3_score": 37.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 29, "recall": 0.4528 }, "low": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-033", "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-013", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-014", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-064", "file": "routes/passphrase.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-067", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-068", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "utils.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvws-node-002", "file": ".env", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-005", "file": "config.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvws-node-057", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-058", "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-061", "file": "public/static/userdisplay.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "public/uploads/admin/creds.xml", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-027", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-036", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-039", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-053", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-055", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-056", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-059", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-076", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": null, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 68, "fp": 17, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.8831, "f1": 0.8395, "f2": 0.8651, "f2_score": 86.5, "f3": 0.874, "f3_score": 87.4, "tpr": 0.8831, "fpr": 1.0, "youden_j": -0.1169, "cvss_coverage": 1.0, "cvss_tp_weight": 420.3, "cvss_fp_weight": 99.7, "cvss_fn_weight": 57.3, "cvss_precision": 0.8082, "cvss_recall": 0.88, "cvss_f3": 0.8723, "cvss_f3_score": 87.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8571 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 24, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.8276 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 46, "fp": 0, "fn": 7, "recall": 0.8679 }, "low": { "tp": 21, "fp": 0, "fn": 1, "recall": 0.9545 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvws-node-001", "file": ".env", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvws-node-002", "file": ".env", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-003", "file": "app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "dvws-node-004", "file": "app.js", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvws-node-006", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-008", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dvws-node-010", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-012", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-013", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-015", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvws-node-017", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-018", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "dvws-node-020", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "dvws-node-022", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-024", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-063", "file": "routes/passphrase.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvws-node-025", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvws-node-027", "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "dvws-node-028", "file": "controllers/storage.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvws-node-029", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-031", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-032", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-033", "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-034", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvws-node-036", "file": "controllers/users.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvws-node-038", "file": "controllers/users.js", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dvws-node-039", "file": "controllers/users.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-041", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-042", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-065", "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-044", "file": "controllers/users.js", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvws-node-045", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-046", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-047", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-049", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-050", "file": "controllers/users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-052", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-053", "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-054", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-055", "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-056", "file": "graphql/schema.js", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-058", "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-059", "file": "public/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-061", "file": "public/static/userdisplay.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-062", "file": "routes/notebook.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-064", "file": "routes/passphrase.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-066", "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvws-node-067", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-068", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvws-node-070", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-073", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-074", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-075", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-076", "file": "utils.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-077", "file": "utils.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-057", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 26, "fp": 34, "fn": 51, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4333, "recall": 0.3377, "f1": 0.3796, "f2": 0.3533, "f2_score": 35.3, "f3": 0.3453, "f3_score": 34.5, "tpr": 0.3377, "fpr": 1.0, "youden_j": -0.6623, "cvss_coverage": 1.0, "cvss_tp_weight": 182.6, "cvss_fp_weight": 193.8, "cvss_fn_weight": 295.0, "cvss_precision": 0.4851, "cvss_recall": 0.3823, "cvss_f3": 0.3906, "cvss_f3_score": 39.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 28, "recall": 0.4717 }, "low": { "tp": 1, "fp": 0, "fn": 21, "recall": 0.0455 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "dvws-node-027", "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "dvws-node-033", "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvws-node-065", "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-013", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-053", "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-055", "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-064", "file": "routes/passphrase.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-057", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-497" }, { "classification": "TP", "ground_truth_id": "dvws-node-001", "file": ".env", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvws-node-076", "file": "utils.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/userdisplay.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "public/home.html", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "dvws-node-059", "file": "public/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "dvws-node-036", "file": "controllers/users.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-039", "file": "controllers/users.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "startup_script.js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": ".env", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "public/passgen.js", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-022", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/index.html", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "dvws-node-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-056", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-058", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-067", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-068", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 77, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.828, "recall": 1.0, "f1": 0.9059, "f2": 0.9601, "f2_score": 96.0, "f3": 0.9796, "f3_score": 98.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 477.6, "cvss_fp_weight": 93.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.8362, "cvss_recall": 1.0, "cvss_f3": 0.9808, "cvss_f3_score": 98.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 29, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 53, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 22, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "dvws-node-001", "file": ".env", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "dvws-node-002", "file": ".env", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-003", "file": "app.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-004", "file": "app.js", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "dvws-node-005", "file": "config.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-006", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-008", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dvws-node-010", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-012", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-013", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-014", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-015", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvws-node-017", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-018", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-020", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-022", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-024", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-025", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "dvws-node-027", "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "dvws-node-028", "file": "controllers/storage.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvws-node-029", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-031", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-032", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-033", "file": "controllers/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "dvws-node-034", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvws-node-036", "file": "controllers/users.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dvws-node-037", "file": "controllers/users.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvws-node-038", "file": "controllers/users.js", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "dvws-node-039", "file": "controllers/users.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "dvws-node-040", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-041", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-042", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-043", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-044", "file": "controllers/users.js", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "dvws-node-045", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-046", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-047", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-048", "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-049", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-050", "file": "controllers/users.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-051", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-052", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-053", "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-054", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-055", "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-056", "file": "graphql/schema.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvws-node-057", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-058", "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-059", "file": "public/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-061", "file": "public/static/userdisplay.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-062", "file": "routes/notebook.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-063", "file": "routes/passphrase.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvws-node-064", "file": "routes/passphrase.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-065", "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvws-node-066", "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "dvws-node-067", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-068", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvws-node-070", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-072", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-073", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-074", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-075", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-076", "file": "utils.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-077", "file": "utils.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rateLimiter.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "public/uploads/admin/creds.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/passgen.js", "cwe": "CWE-338" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 64, "fp": 51, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5565, "recall": 0.8312, "f1": 0.6667, "f2": 0.7565, "f2_score": 75.7, "f3": 0.7921, "f3_score": 79.2, "tpr": 0.8312, "fpr": 1.0, "youden_j": -0.1688, "cvss_coverage": 1.0, "cvss_tp_weight": 388.2, "cvss_fp_weight": 384.5, "cvss_fn_weight": 89.4, "cvss_precision": 0.5024, "cvss_recall": 0.8128, "cvss_f3": 0.7655, "cvss_f3_score": 76.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6429 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 27, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.931 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 12, "recall": 0.7736 }, "low": { "tp": 22, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvws-node-003", "file": "app.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-004", "file": "app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-006", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "dvws-node-008", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-009", "file": "controllers/notebook.js", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "dvws-node-010", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-011", "file": "controllers/notebook.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-012", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-015", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvws-node-017", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "dvws-node-018", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-020", "file": "controllers/notebook.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-022", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-024", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvws-node-025", "file": "controllers/passphrase.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-027", "file": "controllers/storage.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "dvws-node-029", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-031", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-032", "file": "controllers/storage.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvws-node-034", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "dvws-node-036", "file": "controllers/users.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "dvws-node-037", "file": "controllers/users.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "dvws-node-040", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-041", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-042", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-043", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-045", "file": "controllers/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "dvws-node-046", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-047", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "dvws-node-048", "file": "controllers/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-049", "file": "controllers/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-054", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-055", "file": "graphql/schema.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-056", "file": "graphql/schema.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "dvws-node-057", "file": "graphql/schema.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-058", "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-059", "file": "public/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-060", "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/receiver.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-063", "file": "routes/passphrase.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-069", "file": "rpc_server.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-073", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "startup_script.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "startup_script.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "utils.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "dvws-node-076", "file": "utils.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "dvws-node-077", "file": "utils.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "dvws-node-016", "file": "controllers/notebook.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "dvws-node-061", "file": "public/static/userdisplay.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "dvws-node-002", "file": ".env", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".env", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-005", "file": "config.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-050", "file": "controllers/users.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-052", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/uploads/admin/creds.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-074", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-075", "file": "startup_script.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "dvws-node-062", "file": "routes/notebook.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-064", "file": "routes/passphrase.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/storage.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-067", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-068", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "dvws-node-070", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-039", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-053", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 39, "fn": 68, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1875, "recall": 0.1169, "f1": 0.144, "f2": 0.1264, "f2_score": 12.6, "f3": 0.1215, "f3_score": 12.1, "tpr": 0.1169, "fpr": 1.0, "youden_j": -0.8831, "cvss_coverage": 1.0, "cvss_tp_weight": 67.5, "cvss_fp_weight": 253.6, "cvss_fn_weight": 410.1, "cvss_precision": 0.2102, "cvss_recall": 0.1413, "cvss_f3": 0.1461, "cvss_f3_score": 14.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 44, "recall": 0.1698 }, "low": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "dvws-node-007", "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/notebook.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-019", "file": "controllers/notebook.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "dvws-node-021", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "dvws-node-023", "file": "controllers/passphrase.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/passphrase.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-026", "file": "controllers/passphrase.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-030", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "dvws-node-031", "file": "controllers/storage.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "dvws-node-035", "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "graphql/schema.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/angular.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/angular.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/angular.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/angular.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/receiver.js", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "public/static/userdisplay.js", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "dvws-node-071", "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "soapserver/dvwsuserservice.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "dvws-node-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "dvws-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "dvws-node-010", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-016", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "dvws-node-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-024", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-025", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-027", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "dvws-node-028", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-029", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-032", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "dvws-node-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-036", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "dvws-node-037", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "dvws-node-038", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "dvws-node-039", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "dvws-node-040", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-044", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "dvws-node-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-046", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-048", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "dvws-node-049", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-051", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-053", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-055", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "dvws-node-056", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "dvws-node-057", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-058", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-059", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-060", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "dvws-node-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-062", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-063", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "dvws-node-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-065", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-066", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "dvws-node-067", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-068", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-069", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "dvws-node-070", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "dvws-node-072", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "dvws-node-073", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "dvws-node-074", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-075", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "dvws-node-076", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "dvws-node-077", "file": null, "cwe": "CWE-209" } ] }, "sonarqube": null }, "realvuln-extremely-vulnerable-flask-app": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7407, "recall": 0.625, "f1": 0.678, "f2": 0.6452, "f2_score": 64.5, "f3": 0.6349, "f3_score": 63.5, "tpr": 0.625, "fpr": 0.6364, "youden_j": -0.0114, "cvss_coverage": 1.0, "cvss_tp_weight": 146.9, "cvss_fp_weight": 35.0, "cvss_fn_weight": 68.1, "cvss_precision": 0.8074, "cvss_recall": 0.6833, "cvss_f3": 0.6939, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/registration_form.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 7, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4375, "f1": 0.5283, "f2": 0.4698, "f2_score": 47.0, "f3": 0.4531, "f3_score": 45.3, "tpr": 0.4375, "fpr": 0.6364, "youden_j": -0.1989, "cvss_coverage": 1.0, "cvss_tp_weight": 108.6, "cvss_fp_weight": 47.7, "cvss_fn_weight": 106.4, "cvss_precision": 0.695, "cvss_recall": 0.5051, "cvss_f3": 0.5193, "cvss_f3_score": 51.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8506, "recall": 0.4271, "f1": 0.5663, "f2": 0.4734, "f2_score": 47.4, "f3": 0.449, "f3_score": 44.9, "tpr": 0.4271, "fpr": 0.3651, "youden_j": 0.062, "cvss_coverage": 1.0, "cvss_tp_weight": 99.1, "cvss_fp_weight": 11.7, "cvss_fn_weight": 115.9, "cvss_precision": 0.8903, "cvss_recall": 0.4609, "cvss_f3": 0.4841, "cvss_f3_score": 48.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9164, "recall": 0.4583, "f1": 0.6107, "f2": 0.5091, "f2_score": 50.9, "f3": 0.4824, "f3_score": 48.2, "tpr": 0.4583, "fpr": 0.2222, "youden_j": 0.2361, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 9.1, "cvss_fn_weight": 108.0, "cvss_precision": 0.9213, "cvss_recall": 0.4978, "cvss_f3": 0.5217, "cvss_f3_score": 52.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8095, "recall": 0.5312, "f1": 0.6415, "f2": 0.5705, "f2_score": 57.0, "f3": 0.5502, "f3_score": 55.0, "tpr": 0.5312, "fpr": 0.5, "youden_j": 0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 121.7, "cvss_fp_weight": 27.2, "cvss_fn_weight": 93.3, "cvss_precision": 0.8171, "cvss_recall": 0.566, "cvss_f3": 0.584, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 0, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3438, "f1": 0.5116, "f2": 0.3957, "f2_score": 39.6, "f3": 0.3679, "f3_score": 36.8, "tpr": 0.3438, "fpr": 0.0, "youden_j": 0.3438, "cvss_coverage": 1.0, "cvss_tp_weight": 83.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 131.8, "cvss_precision": 1.0, "cvss_recall": 0.387, "cvss_f3": 0.4122, "cvss_f3_score": 41.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 215.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8601, "recall": 0.3958, "f1": 0.5408, "f2": 0.4433, "f2_score": 44.3, "f3": 0.4182, "f3_score": 41.8, "tpr": 0.3958, "fpr": 0.2667, "youden_j": 0.1292, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 15.9, "cvss_fn_weight": 122.4, "cvss_precision": 0.8708, "cvss_recall": 0.4309, "cvss_f3": 0.4535, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 5, "fp": 1, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2917, "recall": 0.1458, "f1": 0.1944, "f2": 0.162, "f2_score": 16.2, "f3": 0.1535, "f3_score": 15.4, "tpr": 0.1458, "fpr": 0.1111, "youden_j": 0.0347, "cvss_coverage": 1.0, "cvss_tp_weight": 33.4, "cvss_fp_weight": 4.5, "cvss_fn_weight": 181.6, "cvss_precision": 0.2935, "cvss_recall": 0.1555, "cvss_f3": 0.1632, "cvss_f3_score": 16.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.5104, "f1": 0.6001, "f2": 0.5412, "f2_score": 54.1, "f3": 0.5252, "f3_score": 52.5, "tpr": 0.5104, "fpr": 0.5068, "youden_j": 0.0036, "cvss_coverage": 1.0, "cvss_tp_weight": 117.1, "cvss_fp_weight": 36.8, "cvss_fn_weight": 97.9, "cvss_precision": 0.7974, "cvss_recall": 0.5445, "cvss_f3": 0.56, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 9, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6786, "recall": 0.5938, "f1": 0.6333, "f2": 0.609, "f2_score": 60.9, "f3": 0.6013, "f3_score": 60.1, "tpr": 0.5938, "fpr": 0.6923, "youden_j": -0.0986, "cvss_coverage": 1.0, "cvss_tp_weight": 136.5, "cvss_fp_weight": 48.7, "cvss_fn_weight": 78.5, "cvss_precision": 0.7372, "cvss_recall": 0.6349, "cvss_f3": 0.6438, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 19, "fp": 0, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5833, "f1": 0.7342, "f2": 0.6352, "f2_score": 63.5, "f3": 0.6082, "f3_score": 60.8, "tpr": 0.5833, "fpr": 0.0, "youden_j": 0.5833, "cvss_coverage": 1.0, "cvss_tp_weight": 131.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 84.0, "cvss_precision": 1.0, "cvss_recall": 0.6093, "cvss_f3": 0.6337, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4375, "f1": 0.6087, "f2": 0.493, "f2_score": 49.3, "f3": 0.4636, "f3_score": 46.4, "tpr": 0.4375, "fpr": 0.0, "youden_j": 0.4375, "cvss_coverage": 1.0, "cvss_tp_weight": 101.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 113.1, "cvss_precision": 1.0, "cvss_recall": 0.474, "cvss_f3": 0.5003, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 30, "fp": 8, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.9375, "f1": 0.8571, "f2": 0.9036, "f2_score": 90.4, "f3": 0.9202, "f3_score": 92.0, "tpr": 0.9375, "fpr": 0.6667, "youden_j": 0.2708, "cvss_coverage": 1.0, "cvss_tp_weight": 202.2, "cvss_fp_weight": 41.9, "cvss_fn_weight": 12.8, "cvss_precision": 0.8285, "cvss_recall": 0.9405, "cvss_f3": 0.9279, "cvss_f3_score": 92.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "low": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/registration_form.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": "app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": "conf/nginx.conf", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 18, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.5625, "f1": 0.6792, "f2": 0.604, "f2_score": 60.4, "f3": 0.5825, "f3_score": 58.3, "tpr": 0.5625, "fpr": 0.4286, "youden_j": 0.1339, "cvss_coverage": 1.0, "cvss_tp_weight": 131.8, "cvss_fp_weight": 20.4, "cvss_fn_weight": 83.2, "cvss_precision": 0.8658, "cvss_recall": 0.613, "cvss_f3": 0.6315, "cvss_f3_score": 63.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "conf/nginx.conf", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 18, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.5625, "f1": 0.6667, "f2": 0.6, "f2_score": 60.0, "f3": 0.5806, "f3_score": 58.1, "tpr": 0.5625, "fpr": 0.5, "youden_j": 0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 27.2, "cvss_fn_weight": 84.9, "cvss_precision": 0.8269, "cvss_recall": 0.6051, "cvss_f3": 0.6218, "cvss_f3_score": 62.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "medium": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": "conf/nginx.conf", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": "app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 23, "fp": 8, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7419, "recall": 0.7188, "f1": 0.7302, "f2": 0.7233, "f2_score": 72.3, "f3": 0.721, "f3_score": 72.1, "tpr": 0.7188, "fpr": 0.6667, "youden_j": 0.0521, "cvss_coverage": 1.0, "cvss_tp_weight": 159.4, "cvss_fp_weight": 48.2, "cvss_fn_weight": 55.6, "cvss_precision": 0.768, "cvss_recall": 0.7414, "cvss_f3": 0.744, "cvss_f3_score": 74.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": "conf/nginx.conf", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/notes.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 3, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.3959, "f1": 0.5299, "f2": 0.4398, "f2_score": 44.0, "f3": 0.4165, "f3_score": 41.6, "tpr": 0.3959, "fpr": 0.3429, "youden_j": 0.053, "cvss_coverage": 1.0, "cvss_tp_weight": 93.4, "cvss_fp_weight": 20.4, "cvss_fn_weight": 121.6, "cvss_precision": 0.8432, "cvss_recall": 0.4346, "cvss_f3": 0.4555, "cvss_f3_score": 45.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 17, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8749, "recall": 0.5209, "f1": 0.651, "f2": 0.5659, "f2_score": 56.6, "f3": 0.5424, "f3_score": 54.2, "tpr": 0.5209, "fpr": 0.3651, "youden_j": 0.1558, "cvss_coverage": 1.0, "cvss_tp_weight": 120.0, "cvss_fp_weight": 15.9, "cvss_fn_weight": 95.0, "cvss_precision": 0.8814, "cvss_recall": 0.558, "cvss_f3": 0.5789, "cvss_f3_score": 57.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 5, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8193, "recall": 0.5417, "f1": 0.6441, "f2": 0.5772, "f2_score": 57.7, "f3": 0.5587, "f3_score": 55.9, "tpr": 0.5417, "fpr": 0.3882, "youden_j": 0.1534, "cvss_coverage": 1.0, "cvss_tp_weight": 122.9, "cvss_fp_weight": 31.9, "cvss_fn_weight": 92.1, "cvss_precision": 0.8293, "cvss_recall": 0.5715, "cvss_f3": 0.5881, "cvss_f3_score": 58.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.5625, "f1": 0.6923, "f2": 0.6081, "f2_score": 60.8, "f3": 0.5844, "f3_score": 58.4, "tpr": 0.5625, "fpr": 0.3333, "youden_j": 0.2292, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 13.6, "cvss_fn_weight": 84.7, "cvss_precision": 0.9054, "cvss_recall": 0.606, "cvss_f3": 0.6268, "cvss_f3_score": 62.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.5, "f1": 0.6038, "f2": 0.5369, "f2_score": 53.7, "f3": 0.5178, "f3_score": 51.8, "tpr": 0.5, "fpr": 0.5556, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 120.1, "cvss_fp_weight": 34.5, "cvss_fn_weight": 94.9, "cvss_precision": 0.7768, "cvss_recall": 0.5586, "cvss_f3": 0.5748, "cvss_f3_score": 57.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 }, "medium": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/account_form.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 30, "fp": 31, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4918, "recall": 0.9375, "f1": 0.6452, "f2": 0.7937, "f2_score": 79.4, "f3": 0.8596, "f3_score": 86.0, "tpr": 0.9375, "fpr": 0.8857, "youden_j": 0.0518, "cvss_coverage": 1.0, "cvss_tp_weight": 199.4, "cvss_fp_weight": 223.5, "cvss_fn_weight": 15.6, "cvss_precision": 0.4715, "cvss_recall": 0.9274, "cvss_f3": 0.8457, "cvss_f3_score": 84.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "uwsgi.ini", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": "conf/nginx.conf", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": "app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/registration_form.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/account_form.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/notes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/registration_codes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "models/registration_code.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/home.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 22, "fp": 16, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.6875, "f1": 0.6286, "f2": 0.6627, "f2_score": 66.3, "f3": 0.6748, "f3_score": 67.5, "tpr": 0.6875, "fpr": 0.8, "youden_j": -0.1125, "cvss_coverage": 1.0, "cvss_tp_weight": 151.6, "cvss_fp_weight": 112.0, "cvss_fn_weight": 63.4, "cvss_precision": 0.5751, "cvss_recall": 0.7051, "cvss_f3": 0.6895, "cvss_f3_score": 69.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "db_seed.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/registration_codes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "models/registration_code.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/registration_codes.py", "cwe": "CWE-324" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/notes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 9, "fp": 3, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2812, "f1": 0.4091, "f2": 0.3214, "f2_score": 32.1, "f3": 0.3, "f3_score": 30.0, "tpr": 0.2812, "fpr": 0.4286, "youden_j": -0.1473, "cvss_coverage": 1.0, "cvss_tp_weight": 70.7, "cvss_fp_weight": 24.0, "cvss_fn_weight": 144.3, "cvss_precision": 0.7466, "cvss_recall": 0.3288, "cvss_f3": 0.3483, "cvss_f3_score": 34.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/account_form.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/account_form.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 28, "fp": 28, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.875, "f1": 0.6364, "f2": 0.7609, "f2_score": 76.1, "f3": 0.814, "f3_score": 81.4, "tpr": 0.875, "fpr": 0.875, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 190.4, "cvss_fp_weight": 207.5, "cvss_fn_weight": 24.6, "cvss_precision": 0.4785, "cvss_recall": 0.8856, "cvss_f3": 0.8162, "cvss_f3_score": 81.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/login_form.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 29, "fp": 6, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8286, "recall": 0.9062, "f1": 0.8657, "f2": 0.8896, "f2_score": 89.0, "f3": 0.8978, "f3_score": 89.8, "tpr": 0.9062, "fpr": 0.6, "youden_j": 0.3063, "cvss_coverage": 1.0, "cvss_tp_weight": 200.5, "cvss_fp_weight": 45.5, "cvss_fn_weight": 14.5, "cvss_precision": 0.815, "cvss_recall": 0.9326, "cvss_f3": 0.9193, "cvss_f3_score": 91.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": "app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 19, "fp": 13, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5938, "recall": 0.5938, "f1": 0.5938, "f2": 0.5938, "f2_score": 59.4, "f3": 0.5938, "f3_score": 59.4, "tpr": 0.5938, "fpr": 0.7647, "youden_j": -0.171, "cvss_coverage": 1.0, "cvss_tp_weight": 133.5, "cvss_fp_weight": 90.0, "cvss_fn_weight": 81.5, "cvss_precision": 0.5973, "cvss_recall": 0.6209, "cvss_f3": 0.6185, "cvss_f3_score": 61.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 28, "fp": 39, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4179, "recall": 0.875, "f1": 0.5657, "f2": 0.7179, "f2_score": 71.8, "f3": 0.7887, "f3_score": 78.9, "tpr": 0.875, "fpr": 0.907, "youden_j": -0.032, "cvss_coverage": 1.0, "cvss_tp_weight": 190.4, "cvss_fp_weight": 275.0, "cvss_fn_weight": 24.6, "cvss_precision": 0.4091, "cvss_recall": 0.8856, "cvss_f3": 0.7932, "cvss_f3_score": 79.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/login_form.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": "models/__init__.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/registration_codes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": "routes/signup.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/signup.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": "templates/account.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": "templates/personal_notes.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/personal_notes.html", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": "utils/profile_image.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 3, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.762, "recall": 0.2917, "f1": 0.4161, "f2": 0.3309, "f2_score": 33.1, "f3": 0.31, "f3_score": 31.0, "tpr": 0.2917, "fpr": 0.4095, "youden_j": -0.1178, "cvss_coverage": 1.0, "cvss_tp_weight": 68.7, "cvss_fp_weight": 20.6, "cvss_fn_weight": 146.3, "cvss_precision": 0.7855, "cvss_recall": 0.3195, "cvss_f3": 0.339, "cvss_f3_score": 33.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": "routes/account.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "forms/account_form.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "models/__init__.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 7, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.375, "f1": 0.4706, "f2": 0.4082, "f2_score": 40.8, "f3": 0.3909, "f3_score": 39.1, "tpr": 0.375, "fpr": 0.6364, "youden_j": -0.2614, "cvss_coverage": 1.0, "cvss_tp_weight": 86.2, "cvss_fp_weight": 22.4, "cvss_fn_weight": 128.8, "cvss_precision": 0.7936, "cvss_recall": 0.4009, "cvss_f3": 0.4218, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": "templates/home.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "routes/registration_codes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": "routes/login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/notes.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/home.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/home.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 0.3438, "f1": 0.5, "f2": 0.3929, "f2_score": 39.3, "f3": 0.3667, "f3_score": 36.7, "tpr": 0.3438, "fpr": 0.2, "youden_j": 0.1437, "cvss_coverage": 1.0, "cvss_tp_weight": 84.7, "cvss_fp_weight": 6.8, "cvss_fn_weight": 130.3, "cvss_precision": 0.9256, "cvss_recall": 0.394, "cvss_f3": 0.418, "cvss_f3_score": 41.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": "routes/signup.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": "utils/profile_image.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": "routes/account.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": "routes/notes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": "routes/account.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "routes/notes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "routes/account.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 2, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.1562, "f1": 0.2564, "f2": 0.1852, "f2_score": 18.5, "f3": 0.1695, "f3_score": 16.9, "tpr": 0.1562, "fpr": 0.3333, "youden_j": -0.1771, "cvss_coverage": 1.0, "cvss_tp_weight": 44.0, "cvss_fp_weight": 1.0, "cvss_fn_weight": 171.0, "cvss_precision": 0.9778, "cvss_recall": 0.2047, "cvss_f3": 0.2222, "cvss_f3_score": 22.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": "app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": "routes/account.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": "routes/login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 8, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.1875, "f1": 0.2609, "f2": 0.2113, "f2_score": 21.1, "f3": 0.1987, "f3_score": 19.9, "tpr": 0.1875, "fpr": 0.6667, "youden_j": -0.4792, "cvss_coverage": 1.0, "cvss_tp_weight": 43.3, "cvss_fp_weight": 54.5, "cvss_fn_weight": 171.7, "cvss_precision": 0.4429, "cvss_recall": 0.2014, "cvss_f3": 0.213, "cvss_f3_score": 21.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-96" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": "routes/account.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": "routes/account.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/account.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": "templates/home.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": "templates/partials/change_image_modal.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": "templates/registration_codes.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/profile_image.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 2, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.125, "f1": 0.2105, "f2": 0.1493, "f2_score": 14.9, "f3": 0.1361, "f3_score": 13.6, "tpr": 0.125, "fpr": 0.3333, "youden_j": -0.2083, "cvss_coverage": 1.0, "cvss_tp_weight": 36.9, "cvss_fp_weight": 19.0, "cvss_fn_weight": 178.1, "cvss_precision": 0.6601, "cvss_recall": 0.1716, "cvss_f3": 0.1853, "cvss_f3_score": 18.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-012", "file": "app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-014", "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-015", "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "db_seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "db_seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "extremely-vulnerable-flask-app-004", "file": "routes/account.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-024", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-028", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-010", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "extremely-vulnerable-flask-app-fp-014", "file": null, "cwe": "CWE-352" } ] } }, "realvuln-flask-xss": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 16, "fp": 9, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.5333, "f1": 0.5818, "f2": 0.5517, "f2_score": 55.2, "f3": 0.5424, "f3_score": 54.2, "tpr": 0.5333, "fpr": 0.6429, "youden_j": -0.1095, "cvss_coverage": 1.0, "cvss_tp_weight": 104.1, "cvss_fp_weight": 37.2, "cvss_fn_weight": 77.1, "cvss_precision": 0.7365, "cvss_recall": 0.5745, "cvss_f3": 0.5874, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/decorators.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 2, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.3, "f1": 0.439, "f2": 0.3435, "f2_score": 34.4, "f3": 0.3203, "f3_score": 32.0, "tpr": 0.3, "fpr": 0.2857, "youden_j": 0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 58.5, "cvss_fp_weight": 10.4, "cvss_fn_weight": 122.7, "cvss_precision": 0.8496, "cvss_recall": 0.3228, "cvss_f3": 0.3442, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 2, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8487, "recall": 0.3111, "f1": 0.4539, "f2": 0.3558, "f2_score": 35.6, "f3": 0.3319, "f3_score": 33.2, "tpr": 0.3111, "fpr": 0.246, "youden_j": 0.0651, "cvss_coverage": 1.0, "cvss_tp_weight": 60.6, "cvss_fp_weight": 7.1, "cvss_fn_weight": 120.6, "cvss_precision": 0.8979, "cvss_recall": 0.3344, "cvss_f3": 0.3565, "cvss_f3_score": 35.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-008", "file": "app/blueprints/api/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 1, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9246, "recall": 0.3889, "f1": 0.5469, "f2": 0.4397, "f2_score": 44.0, "f3": 0.4127, "f3_score": 41.3, "tpr": 0.3889, "fpr": 0.1508, "youden_j": 0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 76.4, "cvss_fp_weight": 3.6, "cvss_fn_weight": 104.8, "cvss_precision": 0.9595, "cvss_recall": 0.4216, "cvss_f3": 0.4465, "cvss_f3_score": 44.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 3, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.5333, "f1": 0.6531, "f2": 0.5755, "f2_score": 57.6, "f3": 0.5536, "f3_score": 55.4, "tpr": 0.5333, "fpr": 0.375, "youden_j": 0.1583, "cvss_coverage": 1.0, "cvss_tp_weight": 101.7, "cvss_fp_weight": 10.9, "cvss_fn_weight": 79.5, "cvss_precision": 0.9036, "cvss_recall": 0.5613, "cvss_f3": 0.5834, "cvss_f3_score": 58.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 2, "fn": 24, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8419, "recall": 0.1889, "f1": 0.2927, "f2": 0.2196, "f2_score": 21.9, "f3": 0.203, "f3_score": 20.3, "tpr": 0.1889, "fpr": 0.2037, "youden_j": -0.0148, "cvss_coverage": 1.0, "cvss_tp_weight": 36.4, "cvss_fp_weight": 8.6, "cvss_fn_weight": 144.8, "cvss_precision": 0.8661, "cvss_recall": 0.2011, "cvss_f3": 0.2158, "cvss_f3_score": 21.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 6, "fp": 2, "fn": 24, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2, "f1": 0.3158, "f2": 0.2344, "f2_score": 23.4, "f3": 0.2158, "f3_score": 21.6, "tpr": 0.2, "fpr": 0.2857, "youden_j": -0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 38.6, "cvss_fp_weight": 10.4, "cvss_fn_weight": 142.6, "cvss_precision": 0.7885, "cvss_recall": 0.213, "cvss_f3": 0.2298, "cvss_f3_score": 23.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 10, "fp": 6, "fn": 20, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6643, "recall": 0.3333, "f1": 0.4383, "f2": 0.368, "f2_score": 36.8, "f3": 0.3498, "f3_score": 34.9, "tpr": 0.3333, "fpr": 0.4853, "youden_j": -0.152, "cvss_coverage": 1.0, "cvss_tp_weight": 67.2, "cvss_fp_weight": 24.9, "cvss_fn_weight": 114.0, "cvss_precision": 0.7627, "cvss_recall": 0.3709, "cvss_f3": 0.3899, "cvss_f3_score": 39.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 13, "fp": 5, "fn": 17, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7382, "recall": 0.4222, "f1": 0.5358, "f2": 0.4612, "f2_score": 46.1, "f3": 0.4408, "f3_score": 44.1, "tpr": 0.4222, "fpr": 0.4563, "youden_j": -0.0341, "cvss_coverage": 1.0, "cvss_tp_weight": 78.4, "cvss_fp_weight": 19.5, "cvss_fn_weight": 102.8, "cvss_precision": 0.8012, "cvss_recall": 0.4328, "cvss_f3": 0.4535, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/components/forms.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/components/forms.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 12, "fp": 5, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7421, "recall": 0.4, "f1": 0.5137, "f2": 0.4382, "f2_score": 43.8, "f3": 0.4181, "f3_score": 41.8, "tpr": 0.4, "fpr": 0.4274, "youden_j": -0.0274, "cvss_coverage": 1.0, "cvss_tp_weight": 78.1, "cvss_fp_weight": 21.1, "cvss_fn_weight": 103.1, "cvss_precision": 0.799, "cvss_recall": 0.4312, "cvss_f3": 0.4514, "cvss_f3_score": 45.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 14, "fp": 3, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.4667, "f1": 0.5957, "f2": 0.5109, "f2_score": 51.1, "f3": 0.4878, "f3_score": 48.8, "tpr": 0.4667, "fpr": 0.375, "youden_j": 0.0917, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 6.2, "cvss_fn_weight": 92.8, "cvss_precision": 0.9347, "cvss_recall": 0.4879, "cvss_f3": 0.5124, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 10, "fp": 0, "fn": 20, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3222, "f1": 0.4872, "f2": 0.3727, "f2_score": 37.3, "f3": 0.3456, "f3_score": 34.6, "tpr": 0.3222, "fpr": 0.0, "youden_j": 0.3222, "cvss_coverage": 1.0, "cvss_tp_weight": 67.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 113.4, "cvss_precision": 1.0, "cvss_recall": 0.3744, "cvss_f3": 0.3993, "cvss_f3_score": 39.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 1, "fn": 17, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.4333, "f1": 0.5909, "f2": 0.4851, "f2_score": 48.5, "f3": 0.4577, "f3_score": 45.8, "tpr": 0.4333, "fpr": 0.1667, "youden_j": 0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 85.3, "cvss_fp_weight": 5.2, "cvss_fn_weight": 95.9, "cvss_precision": 0.9428, "cvss_recall": 0.4708, "cvss_f3": 0.4956, "cvss_f3_score": 49.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 14, "fp": 6, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.4667, "f1": 0.56, "f2": 0.5, "f2_score": 50.0, "f3": 0.4828, "f3_score": 48.3, "tpr": 0.4667, "fpr": 0.5455, "youden_j": -0.0788, "cvss_coverage": 1.0, "cvss_tp_weight": 88.8, "cvss_fp_weight": 21.7, "cvss_fn_weight": 92.4, "cvss_precision": 0.8036, "cvss_recall": 0.4901, "cvss_f3": 0.51, "cvss_f3_score": 51.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 9, "fp": 2, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.3, "f1": 0.439, "f2": 0.3435, "f2_score": 34.4, "f3": 0.3203, "f3_score": 32.0, "tpr": 0.3, "fpr": 0.2857, "youden_j": 0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 55.9, "cvss_fp_weight": 10.4, "cvss_fn_weight": 125.3, "cvss_precision": 0.8437, "cvss_recall": 0.3085, "cvss_f3": 0.3294, "cvss_f3_score": 32.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 8, "fp": 5, "fn": 22, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.2667, "f1": 0.3721, "f2": 0.3008, "f2_score": 30.1, "f3": 0.2827, "f3_score": 28.3, "tpr": 0.2667, "fpr": 0.5, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 50.6, "cvss_fp_weight": 21.2, "cvss_fn_weight": 130.6, "cvss_precision": 0.7047, "cvss_recall": 0.2792, "cvss_f3": 0.2972, "cvss_f3_score": 29.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 15, "fp": 5, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5, "f1": 0.6, "f2": 0.5357, "f2_score": 53.6, "f3": 0.5172, "f3_score": 51.7, "tpr": 0.5, "fpr": 0.5, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 95.3, "cvss_fp_weight": 11.9, "cvss_fn_weight": 85.9, "cvss_precision": 0.8894, "cvss_recall": 0.5259, "cvss_f3": 0.5483, "cvss_f3_score": 54.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 7, "fn": 20, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3444, "f1": 0.4287, "f2": 0.3713, "f2_score": 37.1, "f3": 0.3571, "f3_score": 35.7, "tpr": 0.3444, "fpr": 0.483, "youden_j": -0.1385, "cvss_coverage": 1.0, "cvss_tp_weight": 62.8, "cvss_fp_weight": 34.7, "cvss_fn_weight": 118.4, "cvss_precision": 0.709, "cvss_recall": 0.3464, "cvss_f3": 0.361, "cvss_f3_score": 36.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 2, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8556, "recall": 0.4, "f1": 0.5439, "f2": 0.4473, "f2_score": 44.7, "f3": 0.4223, "f3_score": 42.2, "tpr": 0.4, "fpr": 0.2857, "youden_j": 0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 77.7, "cvss_fp_weight": 7.3, "cvss_fn_weight": 103.5, "cvss_precision": 0.9153, "cvss_recall": 0.4286, "cvss_f3": 0.4523, "cvss_f3_score": 45.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 9, "fn": 17, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6423, "recall": 0.4444, "f1": 0.5168, "f2": 0.4697, "f2_score": 46.9, "f3": 0.4566, "f3_score": 45.6, "tpr": 0.4444, "fpr": 0.5651, "youden_j": -0.1207, "cvss_coverage": 1.0, "cvss_tp_weight": 84.2, "cvss_fp_weight": 19.9, "cvss_fn_weight": 97.0, "cvss_precision": 0.8232, "cvss_recall": 0.4645, "cvss_f3": 0.4851, "cvss_f3_score": 48.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-008", "file": "app/blueprints/api/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-014", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 11, "fp": 1, "fn": 19, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 0.3667, "f1": 0.5238, "f2": 0.4167, "f2_score": 41.7, "f3": 0.3901, "f3_score": 39.0, "tpr": 0.3667, "fpr": 0.1667, "youden_j": 0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 69.4, "cvss_fp_weight": 5.2, "cvss_fn_weight": 111.8, "cvss_precision": 0.9306, "cvss_recall": 0.383, "cvss_f3": 0.4069, "cvss_f3_score": 40.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 1, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9231, "recall": 0.4, "f1": 0.5581, "f2": 0.4511, "f2_score": 45.1, "f3": 0.424, "f3_score": 42.4, "tpr": 0.4, "fpr": 0.1667, "youden_j": 0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 78.7, "cvss_fp_weight": 5.5, "cvss_fn_weight": 102.5, "cvss_precision": 0.9347, "cvss_recall": 0.4343, "cvss_f3": 0.4589, "cvss_f3_score": 45.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-008", "file": "app/blueprints/api/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-014", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 15, "fp": 33, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3125, "recall": 0.5, "f1": 0.3846, "f2": 0.4464, "f2_score": 44.6, "f3": 0.4717, "f3_score": 47.2, "tpr": 0.5, "fpr": 0.8684, "youden_j": -0.3684, "cvss_coverage": 1.0, "cvss_tp_weight": 95.8, "cvss_fp_weight": 222.5, "cvss_fn_weight": 85.4, "cvss_precision": 0.301, "cvss_recall": 0.5287, "cvss_f3": 0.4915, "cvss_f3_score": 49.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-441" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "flask-xss-022", "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "flask-xss-028", "file": "app/models/models.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/admin/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/admin/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 13, "fp": 18, "fn": 17, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4194, "recall": 0.4333, "f1": 0.4262, "f2": 0.4305, "f2_score": 43.0, "f3": 0.4319, "f3_score": 43.2, "tpr": 0.4333, "fpr": 0.7826, "youden_j": -0.3493, "cvss_coverage": 1.0, "cvss_tp_weight": 81.5, "cvss_fp_weight": 98.5, "cvss_fn_weight": 99.7, "cvss_precision": 0.4528, "cvss_recall": 0.4498, "cvss_f3": 0.4501, "cvss_f3_score": 45.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "flask-xss-022", "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 7, "fp": 3, "fn": 23, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.2333, "f1": 0.35, "f2": 0.2692, "f2_score": 26.9, "f3": 0.25, "f3_score": 25.0, "tpr": 0.2333, "fpr": 0.375, "youden_j": -0.1417, "cvss_coverage": 1.0, "cvss_tp_weight": 38.5, "cvss_fp_weight": 19.5, "cvss_fn_weight": 142.7, "cvss_precision": 0.6638, "cvss_recall": 0.2125, "cvss_f3": 0.228, "cvss_f3_score": 22.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 20, "fp": 30, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.6667, "f1": 0.5, "f2": 0.5882, "f2_score": 58.8, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6667, "fpr": 0.8571, "youden_j": -0.1905, "cvss_coverage": 1.0, "cvss_tp_weight": 122.6, "cvss_fp_weight": 206.0, "cvss_fn_weight": 58.6, "cvss_precision": 0.3731, "cvss_recall": 0.6766, "cvss_f3": 0.6257, "cvss_f3_score": 62.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/admin/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "flask-xss-014", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "flask-xss-022", "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/components/forms.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 3, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8929, "recall": 0.8333, "f1": 0.8621, "f2": 0.8446, "f2_score": 84.5, "f3": 0.8389, "f3_score": 83.9, "tpr": 0.8333, "fpr": 0.375, "youden_j": 0.4583, "cvss_coverage": 1.0, "cvss_tp_weight": 145.0, "cvss_fp_weight": 24.0, "cvss_fn_weight": 36.2, "cvss_precision": 0.858, "cvss_recall": 0.8002, "cvss_f3": 0.8056, "cvss_f3_score": 80.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-025", "file": "app/blueprints/admin/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "flask-xss-014", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-024", "file": "app/blueprints/api/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "flask-xss-026", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "flask-xss-008", "file": "app/blueprints/api/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-022", "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "flask-xss-027", "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-028", "file": "app/models/models.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 10, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4737, "recall": 0.3, "f1": 0.3673, "f2": 0.3237, "f2_score": 32.4, "f3": 0.3114, "f3_score": 31.1, "tpr": 0.3, "fpr": 0.6667, "youden_j": -0.3667, "cvss_coverage": 1.0, "cvss_tp_weight": 56.4, "cvss_fp_weight": 69.5, "cvss_fn_weight": 124.8, "cvss_precision": 0.448, "cvss_recall": 0.3113, "cvss_f3": 0.3211, "cvss_f3_score": 32.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 20, "fp": 39, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.339, "recall": 0.6667, "f1": 0.4494, "f2": 0.5587, "f2_score": 55.9, "f3": 0.6079, "f3_score": 60.8, "tpr": 0.6667, "fpr": 0.8864, "youden_j": -0.2197, "cvss_coverage": 1.0, "cvss_tp_weight": 122.6, "cvss_fp_weight": 254.5, "cvss_fn_weight": 58.6, "cvss_precision": 0.3251, "cvss_recall": 0.6766, "cvss_f3": 0.6106, "cvss_f3_score": 61.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-021", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-007", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "flask_xss-fp-008", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/admin/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "flask-xss-017", "file": "app/blueprints/api/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "flask-xss-014", "file": "app/blueprints/api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/decorators.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/templates/login/login.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "flask-xss-022", "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-012", "file": "app/models/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-006", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates/components/forms.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "manage.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 3, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.724, "recall": 0.3, "f1": 0.4234, "f2": 0.3395, "f2_score": 33.9, "f3": 0.3185, "f3_score": 31.8, "tpr": 0.3, "fpr": 0.3981, "youden_j": -0.0981, "cvss_coverage": 1.0, "cvss_tp_weight": 53.4, "cvss_fp_weight": 17.2, "cvss_fn_weight": 127.8, "cvss_precision": 0.7465, "cvss_recall": 0.2949, "cvss_f3": 0.3136, "cvss_f3_score": 31.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-005", "file": "app/templates/admin/message.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-024", "file": "app/blueprints/api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models/models.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-018", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 9, "fn": 30, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6429, "youden_j": -0.6429, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 46.6, "cvss_fn_weight": 181.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "models/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/models.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "flask_xss.py", "cwe": "CWE-1200" }, { "classification": "FP", "ground_truth_id": null, "file": "flask_xss.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-016", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 9, "fp": 3, "fn": 21, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.3, "f1": 0.4286, "f2": 0.3409, "f2_score": 34.1, "f3": 0.3191, "f3_score": 31.9, "tpr": 0.3, "fpr": 0.375, "youden_j": -0.075, "cvss_coverage": 1.0, "cvss_tp_weight": 54.3, "cvss_fp_weight": 6.2, "cvss_fn_weight": 126.9, "cvss_precision": 0.8979, "cvss_recall": 0.2997, "cvss_f3": 0.3211, "cvss_f3_score": 32.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-001", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_params.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-003", "file": "app/blueprints/sandboxes/templates/sandboxes/unsafe_cookies.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-009", "file": "app/templates/_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-013", "file": "app/models/models.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "flask-xss-019", "file": "app/blueprints/login/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-020", "file": "app/blueprints/account_area/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "flask-xss-010", "file": "app/flask_xss.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/api/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-755" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "rowan": { "scanner": "rowan", "tp": 3, "fp": 6, "fn": 27, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.1, "f1": 0.1538, "f2": 0.1163, "f2_score": 11.6, "f3": 0.1075, "f3_score": 10.8, "tpr": 0.1, "fpr": 0.5455, "youden_j": -0.4455, "cvss_coverage": 1.0, "cvss_tp_weight": 19.6, "cvss_fp_weight": 28.0, "cvss_fn_weight": 161.6, "cvss_precision": 0.4118, "cvss_recall": 0.1082, "cvss_f3": 0.1168, "cvss_f3_score": 11.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "flask-xss-023", "file": "app/blueprints/login/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/account_area/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/blueprints/login/views.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "flask-xss-002", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "flask-xss-004", "file": "app/blueprints/sandboxes/views.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-016", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 1, "fn": 27, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.1, "f1": 0.1765, "f2": 0.121, "f2_score": 12.1, "f3": 0.1095, "f3_score": 10.9, "tpr": 0.1, "fpr": 0.1667, "youden_j": -0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 22.2, "cvss_fp_weight": 5.2, "cvss_fn_weight": 159.0, "cvss_precision": 0.8109, "cvss_recall": 0.1225, "cvss_f3": 0.1339, "cvss_f3_score": 13.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 } }, "details": [ { "classification": "TP", "ground_truth_id": "flask-xss-016", "file": "app/blueprints/xss_protection/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "flask-xss-011", "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flask_xss.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "flask-xss-015", "file": "manage.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 30, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "flask-xss-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "flask-xss-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "flask-xss-011", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "flask-xss-012", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "flask-xss-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-014", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-015", "file": null, "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "flask-xss-016", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "flask-xss-017", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "flask-xss-018", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "flask-xss-019", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-020", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-021", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "flask-xss-022", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "flask-xss-023", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "flask-xss-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "flask-xss-025", "file": null, "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "flask-xss-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "flask-xss-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "flask-xss-028", "file": null, "cwe": "CWE-284" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "flask-xss-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "flask_xss-fp-008", "file": null, "cwe": "CWE-352" } ] } }, "realvuln-insecure-web": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 8, "fp": 7, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.8889, "f1": 0.6667, "f2": 0.7843, "f2_score": 78.4, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.8889, "fpr": 0.7778, "youden_j": 0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 30.0, "cvss_fn_weight": 4.3, "cvss_precision": 0.6239, "cvss_recall": 0.9204, "cvss_f3": 0.8786, "cvss_f3_score": 87.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/test.db", "cwe": "CWE-540" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 6, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5385, "recall": 0.7778, "f1": 0.6364, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7447, "f3_score": 74.5, "tpr": 0.7778, "fpr": 0.75, "youden_j": 0.0278, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 25.0, "cvss_fn_weight": 9.1, "cvss_precision": 0.6419, "cvss_recall": 0.8315, "cvss_f3": 0.8076, "cvss_f3_score": 80.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 4, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.7408, "f1": 0.6901, "f2": 0.7189, "f2_score": 71.9, "f3": 0.7295, "f3_score": 73.0, "tpr": 0.7408, "fpr": 0.6381, "youden_j": 0.1027, "cvss_coverage": 1.0, "cvss_tp_weight": 42.9, "cvss_fp_weight": 10.6, "cvss_fn_weight": 11.1, "cvss_precision": 0.8142, "cvss_recall": 0.7951, "cvss_f3": 0.7953, "cvss_f3_score": 79.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-315" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 6, "fp": 2, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8047, "recall": 0.7037, "f1": 0.7456, "f2": 0.7188, "f2_score": 71.9, "f3": 0.7109, "f3_score": 71.1, "tpr": 0.7037, "fpr": 0.4222, "youden_j": 0.2815, "cvss_coverage": 1.0, "cvss_tp_weight": 41.5, "cvss_fp_weight": 6.7, "cvss_fn_weight": 12.5, "cvss_precision": 0.8646, "cvss_recall": 0.7691, "cvss_f3": 0.7771, "cvss_f3_score": 77.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 7, "fp": 1, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.7778, "f1": 0.8235, "f2": 0.7955, "f2_score": 79.5, "f3": 0.7865, "f3_score": 78.7, "tpr": 0.7778, "fpr": 0.3333, "youden_j": 0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 4.9, "cvss_fn_weight": 9.1, "cvss_precision": 0.9014, "cvss_recall": 0.8315, "cvss_f3": 0.838, "cvss_f3_score": 83.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 5, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5556, "f1": 0.6667, "f2": 0.5952, "f2_score": 59.5, "f3": 0.5747, "f3_score": 57.5, "tpr": 0.5556, "fpr": 0.3333, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 34.8, "cvss_fp_weight": 4.9, "cvss_fn_weight": 19.2, "cvss_precision": 0.8764, "cvss_recall": 0.6444, "cvss_f3": 0.662, "cvss_f3_score": 66.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 5, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5556, "f1": 0.6667, "f2": 0.5952, "f2_score": 59.5, "f3": 0.5747, "f3_score": 57.5, "tpr": 0.5556, "fpr": 0.3333, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 34.8, "cvss_fp_weight": 4.9, "cvss_fn_weight": 19.2, "cvss_precision": 0.8764, "cvss_recall": 0.6444, "cvss_f3": 0.662, "cvss_f3_score": 66.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 6, "fp": 5, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7037, "f1": 0.6156, "f2": 0.6639, "f2_score": 66.4, "f3": 0.6829, "f3_score": 68.3, "tpr": 0.7037, "fpr": 0.7093, "youden_j": -0.0055, "cvss_coverage": 1.0, "cvss_tp_weight": 41.5, "cvss_fp_weight": 20.3, "cvss_fn_weight": 12.5, "cvss_precision": 0.6847, "cvss_recall": 0.7691, "cvss_f3": 0.7576, "cvss_f3_score": 75.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 7, "fp": 3, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6788, "recall": 0.7778, "f1": 0.7245, "f2": 0.7555, "f2_score": 75.6, "f3": 0.7664, "f3_score": 76.6, "tpr": 0.7778, "fpr": 0.6667, "youden_j": 0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 11.9, "cvss_fn_weight": 9.1, "cvss_precision": 0.791, "cvss_recall": 0.8315, "cvss_f3": 0.8271, "cvss_f3_score": 82.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 1, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "insecure-web-fp-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 5, "fp": 4, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3462, "recall": 0.5185, "f1": 0.415, "f2": 0.4714, "f2_score": 47.1, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.5185, "fpr": 0.5093, "youden_j": 0.0093, "cvss_coverage": 1.0, "cvss_tp_weight": 29.9, "cvss_fp_weight": 16.9, "cvss_fn_weight": 24.1, "cvss_precision": 0.4279, "cvss_recall": 0.5543, "cvss_f3": 0.5382, "cvss_f3_score": 53.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "insecure-web-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "insecure-web-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 7, "fp": 7, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7778, "f1": 0.6087, "f2": 0.7, "f2_score": 70.0, "f3": 0.7368, "f3_score": 73.7, "tpr": 0.7778, "fpr": 0.7778, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 21.1, "cvss_fn_weight": 9.1, "cvss_precision": 0.6799, "cvss_recall": 0.8315, "cvss_f3": 0.8134, "cvss_f3_score": 81.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-668" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 7, "fp": 2, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7583, "recall": 0.7778, "f1": 0.7657, "f2": 0.7724, "f2_score": 77.2, "f3": 0.775, "f3_score": 77.5, "tpr": 0.7778, "fpr": 0.5111, "youden_j": 0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 10.0, "cvss_fn_weight": 9.1, "cvss_precision": 0.8225, "cvss_recall": 0.8315, "cvss_f3": 0.8302, "cvss_f3_score": 83.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 5, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5556, "f1": 0.6667, "f2": 0.5952, "f2_score": 59.5, "f3": 0.5747, "f3_score": 57.5, "tpr": 0.5556, "fpr": 0.3333, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 34.8, "cvss_fp_weight": 0.5, "cvss_fn_weight": 19.2, "cvss_precision": 0.9858, "cvss_recall": 0.6444, "cvss_f3": 0.6676, "cvss_f3_score": 66.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 9, "fp": 0, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 54.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-008", "file": "app/templates/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 7, "fp": 0, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7778, "f1": 0.875, "f2": 0.814, "f2_score": 81.4, "f3": 0.7955, "f3_score": 79.5, "tpr": 0.7778, "fpr": 0.0, "youden_j": 0.7778, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 9.1, "cvss_precision": 1.0, "cvss_recall": 0.8315, "cvss_f3": 0.8457, "cvss_f3_score": 84.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 8, "fp": 3, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.8889, "f1": 0.8, "f2": 0.8511, "f2_score": 85.1, "f3": 0.8696, "f3_score": 87.0, "tpr": 0.8889, "fpr": 0.6, "youden_j": 0.2889, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 10.3, "cvss_fn_weight": 4.3, "cvss_precision": 0.8281, "cvss_recall": 0.9204, "cvss_f3": 0.9102, "cvss_f3_score": 91.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 9, "fp": 1, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 1.0, "f1": 0.9474, "f2": 0.9783, "f2_score": 97.8, "f3": 0.989, "f3_score": 98.9, "tpr": 1.0, "fpr": 0.3333, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 54.0, "cvss_fp_weight": 4.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.9167, "cvss_recall": 1.0, "cvss_f3": 0.991, "cvss_f3_score": 99.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-008", "file": "app/templates/index.html", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 6, "fp": 2, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7968, "recall": 0.6667, "f1": 0.7178, "f2": 0.6846, "f2_score": 68.5, "f3": 0.6752, "f3_score": 67.5, "tpr": 0.6667, "fpr": 0.4778, "youden_j": 0.1889, "cvss_coverage": 1.0, "cvss_tp_weight": 39.6, "cvss_fp_weight": 6.7, "cvss_fn_weight": 14.4, "cvss_precision": 0.8722, "cvss_recall": 0.7327, "cvss_f3": 0.7424, "cvss_f3_score": 74.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 6, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.6296, "f1": 0.7174, "f2": 0.6612, "f2_score": 66.1, "f3": 0.6449, "f3_score": 64.5, "tpr": 0.6296, "fpr": 0.2778, "youden_j": 0.3519, "cvss_coverage": 1.0, "cvss_tp_weight": 37.5, "cvss_fp_weight": 2.0, "cvss_fn_weight": 16.5, "cvss_precision": 0.9427, "cvss_recall": 0.6938, "cvss_f3": 0.7119, "cvss_f3_score": 71.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 7, "fp": 3, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7135, "recall": 0.7408, "f1": 0.7178, "f2": 0.7293, "f2_score": 72.9, "f3": 0.7346, "f3_score": 73.5, "tpr": 0.7408, "fpr": 0.5492, "youden_j": 0.1915, "cvss_coverage": 1.0, "cvss_tp_weight": 42.9, "cvss_fp_weight": 8.8, "cvss_fn_weight": 11.1, "cvss_precision": 0.8333, "cvss_recall": 0.7951, "cvss_f3": 0.7979, "cvss_f3_score": 79.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 7, "fp": 2, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.7778, "f1": 0.7778, "f2": 0.7778, "f2_score": 77.8, "f3": 0.7778, "f3_score": 77.8, "tpr": 0.7778, "fpr": 0.5, "youden_j": 0.2778, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 5.4, "cvss_fn_weight": 9.1, "cvss_precision": 0.8925, "cvss_recall": 0.8315, "cvss_f3": 0.8372, "cvss_f3_score": 83.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 6, "fp": 0, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.6667, "f1": 0.8, "f2": 0.7143, "f2_score": 71.4, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.6667, "fpr": 0.0, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 38.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.2, "cvss_precision": 1.0, "cvss_recall": 0.7185, "cvss_f3": 0.7393, "cvss_f3_score": 73.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 7, "fp": 16, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3043, "recall": 0.7778, "f1": 0.4375, "f2": 0.5932, "f2_score": 59.3, "f3": 0.6731, "f3_score": 67.3, "tpr": 0.7778, "fpr": 0.8889, "youden_j": -0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 43.6, "cvss_fp_weight": 94.5, "cvss_fn_weight": 10.4, "cvss_precision": 0.3157, "cvss_recall": 0.8074, "cvss_f3": 0.6986, "cvss_f3_score": 69.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-340" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 8, "fp": 13, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.381, "recall": 0.8889, "f1": 0.5333, "f2": 0.7018, "f2_score": 70.2, "f3": 0.7843, "f3_score": 78.4, "tpr": 0.8889, "fpr": 0.8667, "youden_j": 0.0222, "cvss_coverage": 1.0, "cvss_tp_weight": 47.9, "cvss_fp_weight": 88.0, "cvss_fn_weight": 6.1, "cvss_precision": 0.3525, "cvss_recall": 0.887, "cvss_f3": 0.7702, "cvss_f3_score": 77.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "insecure-web-008", "file": "app/templates/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/test.db", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-772" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 0, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3333, "f1": 0.5, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3571, "f3_score": 35.7, "tpr": 0.3333, "fpr": 0.0, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 32.8, "cvss_precision": 1.0, "cvss_recall": 0.3926, "cvss_f3": 0.418, "cvss_f3_score": 41.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 8, "fp": 19, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2963, "recall": 0.8889, "f1": 0.4444, "f2": 0.6349, "f2_score": 63.5, "f3": 0.7407, "f3_score": 74.1, "tpr": 0.8889, "fpr": 0.9048, "youden_j": -0.0159, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 125.0, "cvss_fn_weight": 4.3, "cvss_precision": 0.2845, "cvss_recall": 0.9204, "cvss_f3": 0.7522, "cvss_f3_score": 75.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-453" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 8, "fp": 1, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.8889, "f1": 0.8889, "f2": 0.8889, "f2_score": 88.9, "f3": 0.8889, "f3_score": 88.9, "tpr": 0.8889, "fpr": 0.3333, "youden_j": 0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 48.7, "cvss_fp_weight": 8.0, "cvss_fn_weight": 5.3, "cvss_precision": 0.8589, "cvss_recall": 0.9019, "cvss_f3": 0.8974, "cvss_f3_score": 89.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-008", "file": "app/templates/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-006", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 6, "fp": 3, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.6667, "f1": 0.6667, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.6667, "fpr": 0.6, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 36.1, "cvss_fp_weight": 16.5, "cvss_fn_weight": 17.9, "cvss_precision": 0.6863, "cvss_recall": 0.6685, "cvss_f3": 0.6703, "cvss_f3_score": 67.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 8, "fp": 23, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2581, "recall": 0.8889, "f1": 0.4, "f2": 0.597, "f2_score": 59.7, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.8889, "fpr": 0.92, "youden_j": -0.0311, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 146.0, "cvss_fn_weight": 4.3, "cvss_precision": 0.254, "cvss_recall": 0.9204, "cvss_f3": 0.7291, "cvss_f3_score": 72.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-453" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-005", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 6, "fp": 0, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 0.6297, "f1": 0.7556, "f2": 0.6746, "f2_score": 67.4, "f3": 0.6514, "f3_score": 65.2, "tpr": 0.6297, "fpr": 0.1111, "youden_j": 0.5185, "cvss_coverage": 1.0, "cvss_tp_weight": 37.6, "cvss_fp_weight": 1.6, "cvss_fn_weight": 16.4, "cvss_precision": 0.9588, "cvss_recall": 0.6963, "cvss_f3": 0.7159, "cvss_f3_score": 71.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 5, "fp": 4, "fn": 4, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.5556, "f1": 0.5556, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5556, "fpr": 0.8, "youden_j": -0.2444, "cvss_coverage": 1.0, "cvss_tp_weight": 34.8, "cvss_fp_weight": 19.6, "cvss_fn_weight": 19.2, "cvss_precision": 0.6393, "cvss_recall": 0.6444, "cvss_f3": 0.6439, "cvss_f3_score": 64.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 1, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "insecure-web-fp-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 6, "fp": 3, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.6667, "f1": 0.6667, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.6667, "fpr": 0.6, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 39.0, "cvss_fp_weight": 10.3, "cvss_fn_weight": 15.0, "cvss_precision": 0.7908, "cvss_recall": 0.7222, "cvss_f3": 0.7285, "cvss_f3_score": 72.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-004", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-006", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-538" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "rowan": { "scanner": "rowan", "tp": 3, "fp": 3, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.3333, "f1": 0.4, "f2": 0.3571, "f2_score": 35.7, "f3": 0.3448, "f3_score": 34.5, "tpr": 0.3333, "fpr": 0.6, "youden_j": -0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 18.8, "cvss_fp_weight": 9.0, "cvss_fn_weight": 35.2, "cvss_precision": 0.6763, "cvss_recall": 0.3481, "cvss_f3": 0.3659, "cvss_f3_score": 36.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "insecure-web-009", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "insecure-web-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] }, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 11, "fn": 4, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.3125, "recall": 0.5556, "f1": 0.4, "f2": 0.4808, "f2_score": 48.1, "f3": 0.5155, "f3_score": 51.5, "tpr": 0.5556, "fpr": 0.9167, "youden_j": -0.3611, "cvss_coverage": 1.0, "cvss_tp_weight": 30.5, "cvss_fp_weight": 54.0, "cvss_fn_weight": 23.5, "cvss_precision": 0.3609, "cvss_recall": 0.5648, "cvss_f3": 0.5346, "cvss_f3_score": 53.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 4, "fp": 1, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-007", "file": "app/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "insecure-web-fp-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "insecure-web-008", "file": "app/templates/index.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 3, "fp": 1, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.3333, "f1": 0.4615, "f2": 0.375, "f2_score": 37.5, "f3": 0.3529, "f3_score": 35.3, "tpr": 0.3333, "fpr": 0.3333, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 22.0, "cvss_fp_weight": 9.5, "cvss_fn_weight": 32.0, "cvss_precision": 0.6984, "cvss_recall": 0.4074, "cvss_f3": 0.4251, "cvss_f3_score": 42.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "insecure-web-001", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "insecure-web-002", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "insecure-web-003", "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-668" }, { "classification": "FN", "ground_truth_id": "insecure-web-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "insecure-web-005", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "insecure-web-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "insecure-web-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "insecure-web-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "insecure-web-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "insecure-web-fp-002", "file": null, "cwe": "CWE-79" } ] } }, "realvuln-intentionally-vulnerable-python-application": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 7, "fp": 3, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 1.0, "f1": 0.8235, "f2": 0.9211, "f2_score": 92.1, "f3": 0.9589, "f3_score": 95.9, "tpr": 1.0, "fpr": 0.6, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 17.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.75, "cvss_recall": 1.0, "cvss_f3": 0.9677, "cvss_f3_score": 96.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-778" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 5, "fp": 0, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7143, "f1": 0.8333, "f2": 0.7576, "f2_score": 75.8, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.7143, "fpr": 0.0, "youden_j": 0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 41.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 11.4, "cvss_precision": 1.0, "cvss_recall": 0.7829, "cvss_f3": 0.8002, "cvss_f3_score": 80.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 1, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8611, "recall": 0.8095, "f1": 0.8308, "f2": 0.817, "f2_score": 81.7, "f3": 0.8131, "f3_score": 81.3, "tpr": 0.8095, "fpr": 0.2778, "youden_j": 0.5317, "cvss_coverage": 1.0, "cvss_tp_weight": 45.2, "cvss_fp_weight": 5.8, "cvss_fn_weight": 7.3, "cvss_precision": 0.8925, "cvss_recall": 0.8603, "cvss_f3": 0.8626, "cvss_f3_score": 86.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 4, "fp": 2, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6556, "recall": 0.619, "f1": 0.6261, "f2": 0.6194, "f2_score": 61.9, "f3": 0.6188, "f3_score": 61.9, "tpr": 0.619, "fpr": 0.5111, "youden_j": 0.1079, "cvss_coverage": 1.0, "cvss_tp_weight": 36.0, "cvss_fp_weight": 13.6, "cvss_fn_weight": 16.5, "cvss_precision": 0.7297, "cvss_recall": 0.6851, "cvss_f3": 0.6863, "cvss_f3_score": 68.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 5, "fp": 0, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7143, "f1": 0.8333, "f2": 0.7576, "f2_score": 75.8, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.7143, "fpr": 0.0, "youden_j": 0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 41.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 11.4, "cvss_precision": 1.0, "cvss_recall": 0.7829, "cvss_f3": 0.8002, "cvss_f3_score": 80.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 5, "fp": 0, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7143, "f1": 0.8333, "f2": 0.7576, "f2_score": 75.8, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.7143, "fpr": 0.0, "youden_j": 0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 41.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 11.4, "cvss_precision": 1.0, "cvss_recall": 0.7829, "cvss_f3": 0.8002, "cvss_f3_score": 80.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 4, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5714, "f1": 0.6667, "f2": 0.6061, "f2_score": 60.6, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.5714, "fpr": 0.3333, "youden_j": 0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 33.2, "cvss_fp_weight": 0.5, "cvss_fn_weight": 19.3, "cvss_precision": 0.9852, "cvss_recall": 0.6324, "cvss_f3": 0.6559, "cvss_f3_score": 65.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 4, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7667, "recall": 0.619, "f1": 0.6838, "f2": 0.6432, "f2_score": 64.3, "f3": 0.6308, "f3_score": 63.1, "tpr": 0.619, "fpr": 0.3889, "youden_j": 0.2302, "cvss_coverage": 1.0, "cvss_tp_weight": 36.1, "cvss_fp_weight": 6.0, "cvss_fn_weight": 16.4, "cvss_precision": 0.8678, "cvss_recall": 0.6876, "cvss_f3": 0.7011, "cvss_f3_score": 70.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 5, "fp": 6, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5358, "recall": 0.7619, "f1": 0.6013, "f2": 0.6784, "f2_score": 67.8, "f3": 0.7157, "f3_score": 71.6, "tpr": 0.7619, "fpr": 0.6524, "youden_j": 0.1095, "cvss_coverage": 1.0, "cvss_tp_weight": 42.4, "cvss_fp_weight": 36.9, "cvss_fn_weight": 10.1, "cvss_precision": 0.5966, "cvss_recall": 0.8076, "cvss_f3": 0.7697, "cvss_f3_score": 77.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 4, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.5714, "f1": 0.5744, "f2": 0.5719, "f2_score": 57.2, "f3": 0.5716, "f3_score": 57.2, "tpr": 0.5714, "fpr": 0.1667, "youden_j": 0.4047, "cvss_coverage": 1.0, "cvss_tp_weight": 31.5, "cvss_fp_weight": 3.9, "cvss_fn_weight": 21.0, "cvss_precision": 0.6006, "cvss_recall": 0.5993, "cvss_f3": 0.5988, "cvss_f3_score": 59.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 5, "fp": 3, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.7143, "f1": 0.6667, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.7143, "fpr": 0.6, "youden_j": 0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 41.1, "cvss_fp_weight": 17.5, "cvss_fn_weight": 11.4, "cvss_precision": 0.7014, "cvss_recall": 0.7829, "cvss_f3": 0.7739, "cvss_f3_score": 77.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 6, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.8571, "f1": 0.9231, "f2": 0.8824, "f2_score": 88.2, "f3": 0.8696, "f3_score": 87.0, "tpr": 0.8571, "fpr": 0.0, "youden_j": 0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 47.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 5.3, "cvss_precision": 1.0, "cvss_recall": 0.899, "cvss_f3": 0.9082, "cvss_f3_score": 90.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 2, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.2857, "f1": 0.4, "f2": 0.3226, "f2_score": 32.3, "f3": 0.303, "f3_score": 30.3, "tpr": 0.2857, "fpr": 0.3333, "youden_j": -0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 18.9, "cvss_fp_weight": 0.5, "cvss_fn_weight": 33.6, "cvss_precision": 0.9742, "cvss_recall": 0.36, "cvss_f3": 0.3842, "cvss_f3_score": 38.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 5, "fp": 2, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.5, "youden_j": 0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 11.7, "cvss_fn_weight": 14.7, "cvss_precision": 0.7642, "cvss_recall": 0.72, "cvss_f3": 0.7242, "cvss_f3_score": 72.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 3, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4286, "f1": 0.5455, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4478, "f3_score": 44.8, "tpr": 0.4286, "fpr": 0.3333, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 26.4, "cvss_fp_weight": 5.8, "cvss_fn_weight": 26.1, "cvss_precision": 0.819, "cvss_recall": 0.5029, "cvss_f3": 0.523, "cvss_f3_score": 52.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 5, "fp": 4, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7143, "f1": 0.625, "f2": 0.6757, "f2_score": 67.6, "f3": 0.6944, "f3_score": 69.4, "tpr": 0.7143, "fpr": 0.6667, "youden_j": 0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 23.3, "cvss_fn_weight": 14.7, "cvss_precision": 0.6183, "cvss_recall": 0.72, "cvss_f3": 0.7084, "cvss_f3_score": 70.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 7, "fp": 0, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 5, "fp": 1, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.6667, "f1": 0.7607, "f2": 0.7011, "f2_score": 70.1, "f3": 0.6834, "f3_score": 68.3, "tpr": 0.6667, "fpr": 0.1667, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 38.9, "cvss_fp_weight": 3.9, "cvss_fn_weight": 13.6, "cvss_precision": 0.9159, "cvss_recall": 0.7416, "cvss_f3": 0.7558, "cvss_f3_score": 75.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 5, "fp": 1, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8778, "recall": 0.6667, "f1": 0.7564, "f2": 0.6997, "f2_score": 70.0, "f3": 0.6827, "f3_score": 68.3, "tpr": 0.6667, "fpr": 0.2222, "youden_j": 0.4445, "cvss_coverage": 1.0, "cvss_tp_weight": 38.8, "cvss_fp_weight": 0.3, "cvss_fn_weight": 13.7, "cvss_precision": 0.9912, "cvss_recall": 0.739, "cvss_f3": 0.758, "cvss_f3_score": 75.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 4, "fp": 2, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6972, "recall": 0.619, "f1": 0.6496, "f2": 0.6296, "f2_score": 62.9, "f3": 0.624, "f3_score": 62.4, "tpr": 0.619, "fpr": 0.4778, "youden_j": 0.1413, "cvss_coverage": 1.0, "cvss_tp_weight": 36.1, "cvss_fp_weight": 2.8, "cvss_fn_weight": 16.4, "cvss_precision": 0.9379, "cvss_recall": 0.6876, "cvss_f3": 0.7052, "cvss_f3_score": 70.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 4, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5714, "f1": 0.6667, "f2": 0.6061, "f2_score": 60.6, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.5714, "fpr": 0.3333, "youden_j": 0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 33.6, "cvss_fp_weight": 5.8, "cvss_fn_weight": 18.9, "cvss_precision": 0.8521, "cvss_recall": 0.64, "cvss_f3": 0.6563, "cvss_f3_score": 65.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 6, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.8571, "f1": 0.9231, "f2": 0.8824, "f2_score": 88.2, "f3": 0.8696, "f3_score": 87.0, "tpr": 0.8571, "fpr": 0.0, "youden_j": 0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 46.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.8838, "cvss_f3": 0.8942, "cvss_f3_score": 89.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 7, "fp": 19, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2692, "recall": 1.0, "f1": 0.4242, "f2": 0.6481, "f2_score": 64.8, "f3": 0.7865, "f3_score": 78.7, "tpr": 1.0, "fpr": 0.9048, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 114.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.3144, "cvss_recall": 1.0, "cvss_f3": 0.821, "cvss_f3_score": 82.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-1088" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 6, "fp": 18, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.8571, "f1": 0.3871, "f2": 0.5769, "f2_score": 57.7, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.8571, "fpr": 0.9, "youden_j": -0.0429, "cvss_coverage": 1.0, "cvss_tp_weight": 46.0, "cvss_fp_weight": 114.0, "cvss_fn_weight": 6.5, "cvss_precision": 0.2875, "cvss_recall": 0.8762, "cvss_f3": 0.7273, "cvss_f3_score": 72.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 0, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5714, "f1": 0.7273, "f2": 0.625, "f2_score": 62.5, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5714, "fpr": 0.0, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 34.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 17.9, "cvss_precision": 1.0, "cvss_recall": 0.659, "cvss_f3": 0.6823, "cvss_f3_score": 68.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 7, "fp": 20, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2593, "recall": 1.0, "f1": 0.4118, "f2": 0.6364, "f2_score": 63.6, "f3": 0.7778, "f3_score": 77.8, "tpr": 1.0, "fpr": 0.9091, "youden_j": 0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 123.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2983, "cvss_recall": 1.0, "cvss_f3": 0.8096, "cvss_f3_score": 81.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 7, "fp": 6, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5385, "recall": 1.0, "f1": 0.7, "f2": 0.8537, "f2_score": 85.4, "f3": 0.9211, "f3_score": 92.1, "tpr": 1.0, "fpr": 0.75, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 48.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.5224, "cvss_recall": 1.0, "cvss_f3": 0.9162, "cvss_f3_score": 91.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 6, "fp": 2, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.8571, "f1": 0.8, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8451, "f3_score": 84.5, "tpr": 0.8571, "fpr": 0.5, "youden_j": 0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 43.4, "cvss_fp_weight": 13.5, "cvss_fn_weight": 9.1, "cvss_precision": 0.7627, "cvss_recall": 0.8267, "cvss_f3": 0.8198, "cvss_f3_score": 82.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 7, "fp": 25, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2188, "recall": 1.0, "f1": 0.359, "f2": 0.5833, "f2_score": 58.3, "f3": 0.7368, "f3_score": 73.7, "tpr": 1.0, "fpr": 0.9259, "youden_j": 0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 52.5, "cvss_fp_weight": 153.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2549, "cvss_recall": 1.0, "cvss_f3": 0.7738, "cvss_f3_score": 77.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": "VulnerablePythonScript.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 4, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.5714, "f1": 0.6869, "f2": 0.6124, "f2_score": 61.2, "f3": 0.5911, "f3_score": 59.1, "tpr": 0.5714, "fpr": 0.2222, "youden_j": 0.3492, "cvss_coverage": 1.0, "cvss_tp_weight": 33.6, "cvss_fp_weight": 3.9, "cvss_fn_weight": 18.9, "cvss_precision": 0.9014, "cvss_recall": 0.64, "cvss_f3": 0.6588, "cvss_f3_score": 65.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 6, "fn": 7, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.75, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 35.0, "cvss_fn_weight": 52.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-272" }, { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "path/to/file.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 5, "fp": 3, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.7143, "f1": 0.6667, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.7143, "fpr": 0.6, "youden_j": 0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 41.1, "cvss_fp_weight": 17.5, "cvss_fn_weight": 11.4, "cvss_precision": 0.7014, "cvss_recall": 0.7829, "cvss_f3": 0.7739, "cvss_f3_score": 77.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": "VulnerablePythonScript.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-520" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 4, "fp": 7, "fn": 3, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.3636, "recall": 0.5714, "f1": 0.4444, "f2": 0.5128, "f2_score": 51.3, "f3": 0.5405, "f3_score": 54.1, "tpr": 0.5714, "fpr": 0.875, "youden_j": -0.3036, "cvss_coverage": 1.0, "cvss_tp_weight": 29.1, "cvss_fp_weight": 38.0, "cvss_fn_weight": 23.4, "cvss_precision": 0.4337, "cvss_recall": 0.5543, "cvss_f3": 0.5393, "cvss_f3_score": 53.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "medium": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": "VulnerablePythonScript.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 3, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.2857, "f1": 0.3333, "f2": 0.303, "f2_score": 30.3, "f3": 0.2941, "f3_score": 29.4, "tpr": 0.2857, "fpr": 0.6, "youden_j": -0.3143, "cvss_coverage": 1.0, "cvss_tp_weight": 17.3, "cvss_fp_weight": 17.5, "cvss_fn_weight": 35.2, "cvss_precision": 0.4971, "cvss_recall": 0.3295, "cvss_f3": 0.341, "cvss_f3_score": 34.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "VulnerablePythonScript.py", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": "VulnerablePythonScript.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 7, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 52.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-001", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-005", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "intentionally-vulnerable-python-app-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "intentionally-vulnerable-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-ivna": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 7, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.4211, "f1": 0.4706, "f2": 0.4396, "f2_score": 44.0, "f3": 0.4301, "f3_score": 43.0, "tpr": 0.4211, "fpr": 1.0, "youden_j": -0.5789, "cvss_coverage": 1.0, "cvss_tp_weight": 48.2, "cvss_fp_weight": 36.6, "cvss_fn_weight": 66.1, "cvss_precision": 0.5684, "cvss_recall": 0.4217, "cvss_f3": 0.4329, "cvss_f3_score": 43.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/src/profile-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "ivna-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-014", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 13, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.6316, "f1": 0.5455, "f2": 0.5941, "f2_score": 59.4, "f3": 0.6122, "f3_score": 61.2, "tpr": 0.6316, "fpr": 1.0, "youden_j": -0.3684, "cvss_coverage": 1.0, "cvss_tp_weight": 77.7, "cvss_fp_weight": 67.2, "cvss_fn_weight": 36.6, "cvss_precision": 0.5363, "cvss_recall": 0.6798, "cvss_f3": 0.6621, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/contact.html", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ivna-002", "file": "src/middleware/auth.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ivna-003", "file": "src/models/user.js", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 7, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.4211, "f1": 0.4706, "f2": 0.4396, "f2_score": 44.0, "f3": 0.4301, "f3_score": 43.0, "tpr": 0.4211, "fpr": 1.0, "youden_j": -0.5789, "cvss_coverage": 1.0, "cvss_tp_weight": 51.3, "cvss_fp_weight": 42.1, "cvss_fn_weight": 63.0, "cvss_precision": 0.5492, "cvss_recall": 0.4488, "cvss_f3": 0.4572, "cvss_f3_score": 45.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-009", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ivna-010", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 10, "fp": 15, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.5263, "f1": 0.4545, "f2": 0.495, "f2_score": 49.5, "f3": 0.5102, "f3_score": 51.0, "tpr": 0.5263, "fpr": 1.0, "youden_j": -0.4737, "cvss_coverage": 1.0, "cvss_tp_weight": 58.1, "cvss_fp_weight": 90.2, "cvss_fn_weight": 56.2, "cvss_precision": 0.3917, "cvss_recall": 0.5083, "cvss_f3": 0.4936, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/profile-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/src/profile-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 11, "fp": 14, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.5789, "f1": 0.5, "f2": 0.5446, "f2_score": 54.5, "f3": 0.5612, "f3_score": 56.1, "tpr": 0.5789, "fpr": 1.0, "youden_j": -0.4211, "cvss_coverage": 1.0, "cvss_tp_weight": 67.9, "cvss_fp_weight": 78.7, "cvss_fn_weight": 46.4, "cvss_precision": 0.4631, "cvss_recall": 0.5941, "cvss_f3": 0.5777, "cvss_f3_score": 57.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-015", "file": "src/routers/user.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/src/profile-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 18, "fp": 12, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.9474, "f1": 0.7347, "f2": 0.8491, "f2_score": 84.9, "f3": 0.8955, "f3_score": 89.6, "tpr": 0.9474, "fpr": 1.0, "youden_j": -0.0526, "cvss_coverage": 1.0, "cvss_tp_weight": 104.5, "cvss_fp_weight": 61.2, "cvss_fn_weight": 9.8, "cvss_precision": 0.6308, "cvss_recall": 0.9143, "cvss_f3": 0.8749, "cvss_f3_score": 87.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-002", "file": "src/middleware/auth.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ivna-003", "file": "src/models/user.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "ivna-004", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-005", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-008", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ivna-011", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "ivna-012", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-018", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 10, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5238, "recall": 0.5789, "f1": 0.55, "f2": 0.567, "f2_score": 56.7, "f3": 0.5729, "f3_score": 57.3, "tpr": 0.5789, "fpr": 1.0, "youden_j": -0.4211, "cvss_coverage": 1.0, "cvss_tp_weight": 67.9, "cvss_fp_weight": 60.2, "cvss_fn_weight": 46.4, "cvss_precision": 0.5302, "cvss_recall": 0.5941, "cvss_f3": 0.587, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "ivna-003", "file": "src/models/user.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-015", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 9, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6786, "recall": 1.0, "f1": 0.8085, "f2": 0.9135, "f2_score": 91.3, "f3": 0.9548, "f3_score": 95.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 114.3, "cvss_fp_weight": 54.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.6786, "cvss_recall": 1.0, "cvss_f3": 0.9548, "cvss_f3_score": 95.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-002", "file": "src/middleware/auth.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "ivna-003", "file": "src/models/user.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "ivna-004", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-005", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-008", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ivna-011", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "ivna-012", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "ivna-015", "file": "src/routers/user.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-018", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5429, "recall": 1.0, "f1": 0.7037, "f2": 0.8559, "f2_score": 85.6, "f3": 0.9223, "f3_score": 92.2, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 114.3, "cvss_fp_weight": 118.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.492, "cvss_recall": 1.0, "cvss_f3": 0.9064, "cvss_f3_score": 90.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ivna-001", "file": "public/contact.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/client-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/src/profile-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/src/profile-app.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/templates/views/profile.hbs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "ivna-004", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-005", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-007", "file": "src/routers/task.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-008", "file": "src/routers/task.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-011", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "ivna-012", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ivna-013", "file": "src/routers/user.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ivna-014", "file": "src/routers/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ivna-015", "file": "src/routers/user.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-017", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ivna-018", "file": "src/routers/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ivna-019", "file": "src/routers/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ivna-010", "file": "src/routers/user.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ivna-009", "file": "src/routers/user.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ivna-002", "file": "src/middleware/auth.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ivna-003", "file": "src/models/user.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ivna-006", "file": "src/routers/task.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ivna-016", "file": "src/routers/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-306" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 30, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0323, "recall": 0.0526, "f1": 0.04, "f2": 0.0467, "f2_score": 4.7, "f3": 0.0495, "f3_score": 5.0, "tpr": 0.0526, "fpr": 1.0, "youden_j": -0.9474, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 169.4, "cvss_fn_weight": 104.5, "cvss_precision": 0.0547, "cvss_recall": 0.0857, "cvss_f3": 0.0811, "cvss_f3_score": 8.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "public/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "public/templates/partials/header.hbs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/templates/views/layouts.hbs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/models/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/task.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ivna-015", "file": "src/routers/user.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routers/user.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ivna-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ivna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ivna-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-005", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ivna-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "ivna-008", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-009", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ivna-010", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ivna-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-013", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "ivna-014", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "ivna-016", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ivna-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "ivna-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ivna-019", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": null }, "realvuln-juice-shop": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 15, "fn": 69, "tn": 0, "ns": 0, "ns_gt": 64, "precision": 0.4444, "recall": 0.1481, "f1": 0.2222, "f2": 0.1709, "f2_score": 17.1, "f3": 0.1587, "f3_score": 15.9, "tpr": 0.1481, "fpr": 1.0, "youden_j": -0.8519, "cvss_coverage": 1.0, "cvss_tp_weight": 81.9, "cvss_fp_weight": 85.8, "cvss_fn_weight": 411.7, "cvss_precision": 0.4883, "cvss_recall": 0.1659, "cvss_f3": 0.1777, "cvss_f3_score": 17.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.0952 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 52, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-060", "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-158" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-052", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "juice-shop-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-059", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-084", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-111", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-131", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-134", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-139", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-142", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 36, "fn": 68, "tn": 0, "ns": 0, "ns_gt": 64, "precision": 0.2653, "recall": 0.1605, "f1": 0.2, "f2": 0.1743, "f2_score": 17.4, "f3": 0.1671, "f3_score": 16.7, "tpr": 0.1605, "fpr": 1.0, "youden_j": -0.8395, "cvss_coverage": 1.0, "cvss_tp_weight": 83.0, "cvss_fp_weight": 202.6, "cvss_fn_weight": 410.6, "cvss_precision": 0.2906, "cvss_recall": 0.1682, "cvss_f3": 0.1756, "cvss_f3_score": 17.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.0952 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 52, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateProductReviews.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/b2bOrder.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-98" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basket.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-052", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-059", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-078", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-084", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-128", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-134", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-142", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 18, "fn": 68, "tn": 0, "ns": 0, "ns_gt": 64, "precision": 0.4194, "recall": 0.1605, "f1": 0.2321, "f2": 0.1831, "f2_score": 18.3, "f3": 0.1711, "f3_score": 17.1, "tpr": 0.1605, "fpr": 1.0, "youden_j": -0.8395, "cvss_coverage": 1.0, "cvss_tp_weight": 90.1, "cvss_fp_weight": 98.5, "cvss_fn_weight": 403.5, "cvss_precision": 0.4777, "cvss_recall": 0.1825, "cvss_f3": 0.1946, "cvss_f3_score": 19.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.0476 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 52, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-060", "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/checkKeys.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-052", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-057", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-111", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-128", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-129", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-134", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-142", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 26, "fn": 61, "tn": 0, "ns": 1, "ns_gt": 64, "precision": 0.4348, "recall": 0.2469, "f1": 0.315, "f2": 0.2703, "f2_score": 27.0, "f3": 0.2581, "f3_score": 25.8, "tpr": 0.2469, "fpr": 1.0, "youden_j": -0.7531, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 158.4, "cvss_fn_weight": 363.3, "cvss_precision": 0.4513, "cvss_recall": 0.264, "cvss_f3": 0.2754, "cvss_f3_score": 27.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.0476 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 44, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-063", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-060", "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/securityQuestion.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-045", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-046", "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/checkKeys.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": "routes/continueCode.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-052", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-111", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-128", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-131", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-134", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 40, "fn": 58, "tn": 0, "ns": 0, "ns_gt": 64, "precision": 0.3651, "recall": 0.284, "f1": 0.3194, "f2": 0.2972, "f2_score": 29.7, "f3": 0.2904, "f3_score": 29.0, "tpr": 0.284, "fpr": 1.0, "youden_j": -0.716, "cvss_coverage": 1.0, "cvss_tp_weight": 152.9, "cvss_fp_weight": 215.8, "cvss_fn_weight": 340.7, "cvss_precision": 0.4147, "cvss_recall": 0.3098, "cvss_f3": 0.3178, "cvss_f3_score": 31.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.0476 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 42, "recall": 0.3438 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-134", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-055", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-076", "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/securityQuestion.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/checkKeys.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/oauth/oauth.component.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/wallet.ts", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "juice-shop-115", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-052", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-057", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 45, "fp": 47, "fn": 36, "tn": 0, "ns": 2, "ns_gt": 64, "precision": 0.4891, "recall": 0.5556, "f1": 0.5202, "f2": 0.5409, "f2_score": 54.1, "f3": 0.5481, "f3_score": 54.8, "tpr": 0.5556, "fpr": 1.0, "youden_j": -0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 276.7, "cvss_fp_weight": 280.8, "cvss_fn_weight": 216.9, "cvss_precision": 0.4963, "cvss_recall": 0.5606, "cvss_f3": 0.5534, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 43, "fp": 0, "fn": 21, "recall": 0.6719 }, "low": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-134", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-180" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-108", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-045", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-046", "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "juice-shop-052", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-087", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-047", "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-067", "file": "routes/checkKeys.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-100", "file": "routes/nftMint.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": "routes/resetPassword.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-104", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-073", "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-063", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-074", "file": "routes/createProductReviews.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-143", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-097", "file": "routes/memory.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-141", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-098", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "juice-shop-065", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-114", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/user.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/user.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "juice-shop-055", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-056", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-132", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-133", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-804" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-804" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-636" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/card.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "juice-shop-079", "file": "routes/deluxe.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "juice-shop-138", "file": "routes/wallet.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "juice-shop-070", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-131", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 61, "fn": 57, "tn": 0, "ns": 1, "ns_gt": 64, "precision": 0.2824, "recall": 0.2963, "f1": 0.2892, "f2": 0.2934, "f2_score": 29.3, "f3": 0.2948, "f3_score": 29.5, "tpr": 0.2963, "fpr": 1.0, "youden_j": -0.7037, "cvss_coverage": 1.0, "cvss_tp_weight": 151.9, "cvss_fp_weight": 360.5, "cvss_fn_weight": 341.7, "cvss_precision": 0.2964, "cvss_recall": 0.3077, "cvss_f3": 0.3066, "cvss_f3_score": 30.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 41, "recall": 0.3594 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-046", "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-058", "file": "models/user.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/oauth/oauth.component.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/resetPassword.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-104", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-073", "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-235" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/verify.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-143", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-180" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/resetPassword.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/user.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/request.interceptor.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-047", "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-052", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/card.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-1284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/oauth/oauth.component.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-132", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-409" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/b2bOrder.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-770" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": "routes/nftMint.ts", "cwe": "CWE-772" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/metrics.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "juice-shop-100", "file": "routes/nftMint.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-057", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-061", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-111", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-134", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-139", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 81, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 64, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 493.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 64, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-020", "file": "data/static/users.yml", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-043", "file": "frontend/src/app/about/about.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-045", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-046", "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-047", "file": "frontend/src/app/login/login.component.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-048", "file": "frontend/src/app/product-details/product-details.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-049", "file": "frontend/src/app/search-result/search-result.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-051", "file": "frontend/src/hacking-instructor/challenges/loginJim.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-052", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-053", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-054", "file": "lib/insecurity.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-055", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-056", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-058", "file": "models/user.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-060", "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-063", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-064", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-065", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-066", "file": "routes/chatbot.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-067", "file": "routes/checkKeys.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-068", "file": "routes/continueCode.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-070", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "juice-shop-073", "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-074", "file": "routes/createProductReviews.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "juice-shop-075", "file": "routes/createProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-076", "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-077", "file": "routes/dataErasure.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-078", "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-079", "file": "routes/deluxe.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "juice-shop-080", "file": "routes/deluxe.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-082", "file": "routes/fileServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-083", "file": "routes/fileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "juice-shop-085", "file": "routes/keyServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-086", "file": "routes/likeProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-087", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-088", "file": "routes/login.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-097", "file": "routes/memory.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-098", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-100", "file": "routes/nftMint.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-101", "file": "routes/nftMint.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-103", "file": "routes/nftMint.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-104", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-106", "file": "routes/profileImageFileUpload.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-108", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "juice-shop-109", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-112", "file": "routes/resetPassword.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-113", "file": "routes/resetPassword.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-114", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-115", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-123", "file": "routes/saveLoginIp.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-130", "file": "routes/updateProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-132", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-133", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-134", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-136", "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-137", "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-138", "file": "routes/wallet.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-140", "file": "routes/web3Wallet.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-141", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-143", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-144", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-145", "file": "server.ts", "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 68, "fp": 89, "fn": 13, "tn": 0, "ns": 33, "ns_gt": 64, "precision": 0.4331, "recall": 0.8395, "f1": 0.5714, "f2": 0.7069, "f2_score": 70.7, "f3": 0.7675, "f3_score": 76.7, "tpr": 0.8395, "fpr": 1.0, "youden_j": -0.1605, "cvss_coverage": 1.0, "cvss_tp_weight": 401.7, "cvss_fp_weight": 702.5, "cvss_fn_weight": 91.9, "cvss_precision": 0.3638, "cvss_recall": 0.8138, "cvss_f3": 0.7242, "cvss_f3_score": 72.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 53, "fp": 0, "fn": 11, "recall": 0.8281 }, "low": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "juice-shop-043", "file": "frontend/src/app/about/about.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-044", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-045", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-046", "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/feedback-details/feedback-details.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-048", "file": "frontend/src/app/product-details/product-details.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/score-board/components/challenge-card/challenge-card.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/score-board/score-board.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-049", "file": "frontend/src/app/search-result/search-result.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/track-result/track-result.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-050", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/welcome-banner/welcome-banner.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hacking-instructor/index.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/antiCheat.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-054", "file": "lib/insecurity.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/startup/restoreOverwrittenFilesWithOriginals.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-057", "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-059", "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-060", "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "juice-shop-061", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-062", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-063", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/chatbot.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/chatbot.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-066", "file": "routes/chatbot.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/checkKeys.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/checkKeys.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-073", "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-075", "file": "routes/createProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-076", "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-077", "file": "routes/dataErasure.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-080", "file": "routes/deluxe.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-083", "file": "routes/fileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-086", "file": "routes/likeProductReviews.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-088", "file": "routes/login.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-098", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-101", "file": "routes/nftMint.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-103", "file": "routes/nftMint.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-104", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageFileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-106", "file": "routes/profileImageFileUpload.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-107", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-109", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-113", "file": "routes/resetPassword.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-115", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-123", "file": "routes/saveLoginIp.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-128", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-130", "file": "routes/updateProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-131", "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-134", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-136", "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-137", "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-140", "file": "routes/web3Wallet.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-145", "file": "server.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "juice-shop-055", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-056", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "juice-shop-070", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-132", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-133", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-065", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-114", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/resetPassword.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/resetPassword.ts", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/lint-fixer.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/pr-compliance.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-ebook.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www-legacy.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-news-www-legacy.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-news-www.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "ftp/suspicious_errors.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-052", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-053", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-067", "file": "routes/checkKeys.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-087", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-100", "file": "routes/nftMint.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/wallet.ts", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "juice-shop-139", "file": "routes/web3Wallet.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-082", "file": "routes/fileServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-085", "file": "routes/keyServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-097", "file": "routes/memory.ts", "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": "routes/nftMint.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/orderHistory.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": "routes/privacyPolicyProof.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-141", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-142", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-143", "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-078", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 68, "fn": 72, "tn": 0, "ns": 4, "ns_gt": 64, "precision": 0.1169, "recall": 0.1111, "f1": 0.1139, "f2": 0.1122, "f2_score": 11.2, "f3": 0.1117, "f3_score": 11.2, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 69.5, "cvss_fp_weight": 437.3, "cvss_fn_weight": 424.1, "cvss_precision": 0.1371, "cvss_recall": 0.1408, "cvss_f3": 0.1404, "cvss_f3_score": 14.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 55, "recall": 0.1406 }, "low": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-ebook.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www-legacy.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www-legacy.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/update-challenges-www.yml", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": ".npmrc", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/restfulXssChallenge_2.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/restfulXssChallenge_2.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/.npmrc", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/app.guard.spec.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.spec.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.spec.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hacking-instructor/helpers/helpers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/utils.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/b2bOrder.ts", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/chatbot.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-084", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-089", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/orderHistory.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/orderHistory.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-111", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-125", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-126", "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-127", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-129", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-134", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "views/promotionVideo.pug", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-052", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-053", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-054", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-055", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-056", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-057", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-058", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "juice-shop-059", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-061", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-064", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-065", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-066", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-067", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-068", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-070", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "juice-shop-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-074", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "juice-shop-075", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-076", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-077", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-078", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "juice-shop-079", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-080", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-082", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-083", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-085", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-086", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-087", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-088", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-097", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-098", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-100", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-101", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-104", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-106", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-107", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "juice-shop-108", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "juice-shop-109", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-112", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-113", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-114", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-115", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-123", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-128", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-130", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-131", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-132", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-133", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-136", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-137", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-138", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "juice-shop-139", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-140", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-141", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-142", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-143", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "juice-shop-144", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-145", "file": null, "cwe": "CWE-489" }, { "classification": "NS", "ground_truth_id": "juice-shop-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-024", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-025", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-026", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-027", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-028", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-029", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-030", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-031", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-032", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-033", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-034", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-035", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-036", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-038", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-039", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-040", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-041", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-069", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-071", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-072", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-081", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-090", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-091", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-092", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-093", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-094", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-095", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-096", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-099", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-102", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-105", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-110", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-116", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-117", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-118", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-119", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-120", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-121", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-122", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-124", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-135", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": null }, "realvuln-juice-shop-goof": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 40, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.322, "recall": 0.3725, "f1": 0.3455, "f2": 0.3612, "f2_score": 36.1, "f3": 0.3668, "f3_score": 36.7, "tpr": 0.3725, "fpr": 1.0, "youden_j": -0.6275, "cvss_coverage": 1.0, "cvss_tp_weight": 141.7, "cvss_fp_weight": 220.5, "cvss_fn_weight": 184.5, "cvss_precision": 0.3913, "cvss_recall": 0.4344, "cvss_f3": 0.4297, "cvss_f3_score": 43.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 28, "recall": 0.4043 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateProductReviews.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-051", "file": "routes/logfileServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeFixes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-033", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-032", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "models/card.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/feedback-details/feedback-details.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/oauth/oauth.component.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 9, "fn": 39, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.5714, "recall": 0.2353, "f1": 0.3333, "f2": 0.2667, "f2_score": 26.7, "f3": 0.25, "f3_score": 25.0, "tpr": 0.2353, "fpr": 1.0, "youden_j": -0.7647, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 51.7, "cvss_fn_weight": 233.2, "cvss_precision": 0.6428, "cvss_recall": 0.2851, "cvss_f3": 0.3019, "cvss_f3_score": 30.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 35, "recall": 0.2553 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-023", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-026", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 20, "fn": 37, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.4118, "recall": 0.2745, "f1": 0.3294, "f2": 0.2941, "f2_score": 29.4, "f3": 0.284, "f3_score": 28.4, "tpr": 0.2745, "fpr": 1.0, "youden_j": -0.7255, "cvss_coverage": 1.0, "cvss_tp_weight": 111.5, "cvss_fp_weight": 127.9, "cvss_fn_weight": 214.7, "cvss_precision": 0.4657, "cvss_recall": 0.3418, "cvss_f3": 0.3512, "cvss_f3_score": 35.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 33, "recall": 0.2979 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-052", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-030", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-067", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 22, "fn": 35, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.4211, "recall": 0.3137, "f1": 0.3596, "f2": 0.3306, "f2_score": 33.1, "f3": 0.3219, "f3_score": 32.2, "tpr": 0.3137, "fpr": 1.0, "youden_j": -0.6863, "cvss_coverage": 1.0, "cvss_tp_weight": 116.3, "cvss_fp_weight": 117.1, "cvss_fn_weight": 209.9, "cvss_precision": 0.4982, "cvss_recall": 0.3565, "cvss_f3": 0.367, "cvss_f3_score": 36.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 31, "recall": 0.3404 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeFixes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/memory.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/score-board/score-board.component.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-087", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 45, "fn": 33, "tn": 0, "ns": 1, "ns_gt": 37, "precision": 0.2857, "recall": 0.3529, "f1": 0.3158, "f2": 0.3371, "f2_score": 33.7, "f3": 0.3448, "f3_score": 34.5, "tpr": 0.3529, "fpr": 1.0, "youden_j": -0.6471, "cvss_coverage": 1.0, "cvss_tp_weight": 133.7, "cvss_fp_weight": 228.9, "cvss_fn_weight": 192.5, "cvss_precision": 0.3688, "cvss_recall": 0.4099, "cvss_f3": 0.4054, "cvss_f3_score": 40.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 29, "recall": 0.383 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateProductReviews.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/saveLoginIp.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/orderHistory.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-088", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-032", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/wallet.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-305" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": "routes/continueCode.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-067", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 45, "fp": 22, "fn": 6, "tn": 0, "ns": 1, "ns_gt": 37, "precision": 0.6716, "recall": 0.8824, "f1": 0.7627, "f2": 0.8303, "f2_score": 83.0, "f3": 0.8555, "f3_score": 85.6, "tpr": 0.8824, "fpr": 1.0, "youden_j": -0.1176, "cvss_coverage": 1.0, "cvss_tp_weight": 285.4, "cvss_fp_weight": 140.7, "cvss_fn_weight": 40.8, "cvss_precision": 0.6698, "cvss_recall": 0.8749, "cvss_f3": 0.8489, "cvss_f3_score": 84.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 42, "fp": 0, "fn": 5, "recall": 0.8936 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-031", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-032", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-033", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-037", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-038", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-039", "file": "routes/changePassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-040", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/user.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-041", "file": "routes/chatbot.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-042", "file": "routes/continueCode.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-046", "file": "routes/dataErasure.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-048", "file": "routes/fileServer.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-051", "file": "routes/logfileServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-052", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-060", "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-061", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-062", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-064", "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-068", "file": "routes/resetPassword.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-069", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-070", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-077", "file": "routes/saveLoginIp.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-080", "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-083", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-084", "file": "routes/updateProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-085", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-086", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/verify.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/verify.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 19, "fp": 64, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.2289, "recall": 0.3725, "f1": 0.2836, "f2": 0.331, "f2_score": 33.1, "f3": 0.3506, "f3_score": 35.1, "tpr": 0.3725, "fpr": 1.0, "youden_j": -0.6275, "cvss_coverage": 1.0, "cvss_tp_weight": 126.7, "cvss_fp_weight": 397.6, "cvss_fn_weight": 199.5, "cvss_precision": 0.2417, "cvss_recall": 0.3884, "cvss_f3": 0.3662, "cvss_f3_score": 36.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 28, "recall": 0.4043 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/b2bOrder.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/startup/registerWebsocketEvents.ts", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/oauth/oauth.component.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/resetPassword.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-060", "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/premiumReward.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-804" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-180" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-062", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-037", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-038", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-083", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basketItems.ts", "cwe": "CWE-1284" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/Services/user.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/card.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "test/logcapture.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-085", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-067", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-087", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 49, "fp": 29, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 37, "precision": 0.6282, "recall": 0.9608, "f1": 0.7597, "f2": 0.8688, "f2_score": 86.9, "f3": 0.9125, "f3_score": 91.2, "tpr": 0.9608, "fpr": 1.0, "youden_j": -0.0392, "cvss_coverage": 1.0, "cvss_tp_weight": 309.0, "cvss_fp_weight": 173.7, "cvss_fn_weight": 17.2, "cvss_precision": 0.6402, "cvss_recall": 0.9473, "cvss_f3": 0.9039, "cvss_f3_score": 90.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 9, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 45, "fp": 0, "fn": 2, "recall": 0.9574 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "juice-shop-goof-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-028", "file": "frontend/src/hacking-instructor/challenges/loginJim.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-031", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-032", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-033", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-037", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-038", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-039", "file": "routes/changePassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-040", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-041", "file": "routes/chatbot.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-042", "file": "routes/continueCode.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-046", "file": "routes/dataErasure.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-047", "file": "routes/deluxe.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/deluxe.ts", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-048", "file": "routes/fileServer.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-051", "file": "routes/logfileServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-052", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-060", "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-061", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-062", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-063", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-064", "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-068", "file": "routes/resetPassword.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-069", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-070", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-077", "file": "routes/saveLoginIp.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-080", "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-083", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-084", "file": "routes/updateProductReviews.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-085", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-086", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/imageCaptcha.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/verify.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-088", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 45, "fp": 86, "fn": 6, "tn": 0, "ns": 29, "ns_gt": 37, "precision": 0.3435, "recall": 0.8824, "f1": 0.4945, "f2": 0.6716, "f2_score": 67.2, "f3": 0.7627, "f3_score": 76.3, "tpr": 0.8824, "fpr": 1.0, "youden_j": -0.1176, "cvss_coverage": 1.0, "cvss_tp_weight": 284.4, "cvss_fp_weight": 663.0, "cvss_fn_weight": 41.8, "cvss_precision": 0.3002, "cvss_recall": 0.8719, "cvss_f3": 0.7324, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 6, "recall": 0.8723 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-022", "file": "frontend/src/app/about/about.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/administration/administration.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-023", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-024", "file": "frontend/src/app/administration/administration.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/data-export/data-export.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/feedback-details/feedback-details.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/product-details/product-details.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/score-board/score-board.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/score-board/score-board.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/search-result/search-result.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-025", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/track-result/track-result.component.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-027", "file": "frontend/src/app/track-result/track-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/welcome-banner/welcome-banner.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hacking-instructor/index.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-030", "file": "lib/insecurity.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/2fa.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/appConfiguration.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/authenticatedUsers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-035", "file": "routes/b2bOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-036", "file": "routes/basket.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-037", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-038", "file": "routes/basketItems.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-039", "file": "routes/changePassword.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/chatbot.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/chatbot.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-041", "file": "routes/chatbot.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/coupon.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-046", "file": "routes/dataErasure.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-047", "file": "routes/deluxe.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-049", "file": "routes/fileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-060", "file": "routes/memory.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-061", "file": "routes/metrics.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-062", "file": "routes/order.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageFileUpload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/recycles.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-070", "file": "routes/resetPassword.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-077", "file": "routes/saveLoginIp.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-080", "file": "routes/securityQuestion.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-083", "file": "routes/updateProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-084", "file": "routes/updateProductReviews.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-087", "file": "routes/userProfile.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-033", "file": "lib/insecurity.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-032", "file": "lib/insecurity.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": "routes/continueCode.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/restoreProgress.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-086", "file": "routes/updateUserProfile.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-085", "file": "routes/updateUserProfile.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-040", "file": "routes/changePassword.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-069", "file": "routes/resetPassword.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "ftp/suspicious_errors.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-029", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-031", "file": "lib/insecurity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-052", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": "routes/login.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/wallet.ts", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/basket.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/changePassword.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/coupon.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/createProductReviews.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/currentUser.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-051", "file": "routes/logfileServer.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-064", "file": "routes/premiumReward.ts", "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": "routes/privacyPolicyProof.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/trackOrder.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-088", "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 97, "fn": 42, "tn": 0, "ns": 1, "ns_gt": 37, "precision": 0.0849, "recall": 0.1765, "f1": 0.1146, "f2": 0.1452, "f2_score": 14.5, "f3": 0.1593, "f3_score": 15.9, "tpr": 0.1765, "fpr": 1.0, "youden_j": -0.8235, "cvss_coverage": 1.0, "cvss_tp_weight": 68.5, "cvss_fp_weight": 626.1, "cvss_fn_weight": 257.7, "cvss_precision": 0.0986, "cvss_recall": 0.21, "cvss_f3": 0.1887, "cvss_f3_score": 18.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 38, "recall": 0.1915 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/build-container-and-push.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".npmrc", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "catalog-info.yaml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "data/datacreator.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/dbSchemaChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/restfulXssChallenge_2.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/restfulXssChallenge_2.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_1.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "data/static/codefixes/unionSqlInjectionChallenge_3.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-001", "file": "data/static/users.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.test.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.test.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/.npmrc", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/app.guard.spec.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.spec.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/last-login-ip/last-login-ip.component.spec.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-026", "file": "frontend/src/app/search-result/search-result.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hacking-instructor/helpers/helpers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "k8s-src/juice-shop-deploy.yaml", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "k8s-src/juice-shop-deploy.yaml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "k8s-src/juice-shop-deploy.yaml", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/codingChallenges.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/insecurity.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/startup/restoreOverwrittenFilesWithOriginals.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/startup/validatePreconditions.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/utils.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "models/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/b2bOrder.ts", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/captcha.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataErasure.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/dataExport.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/fileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-050", "file": "routes/fileUpload.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/keyServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/likeProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/logfileServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-053", "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/order.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageFileUpload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-066", "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/profileImageUrlUpload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/quarantineServer.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-067", "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/redirect.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-079", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": "routes/search.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/showProductReviews.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-081", "file": "routes/trackOrder.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "juice-shop-goof-082", "file": "routes/updateProductReviews.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/updateUserProfile.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/userProfile.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/videoHandler.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeFixes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeFixes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/vulnCodeSnippet.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "server.ts", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "views/promotionVideo.pug", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-022", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-023", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-030", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-031", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-040", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-046", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-047", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-048", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-051", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-052", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-060", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-061", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-062", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-063", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-064", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-068", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-069", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-070", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-077", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-080", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-083", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-084", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-085", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-086", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-087", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "juice-shop-goof-088", "file": null, "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-043", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-044", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-045", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-054", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-055", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-056", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-057", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-058", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-059", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-065", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-071", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-072", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-073", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-074", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-075", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-076", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "juice-shop-goof-078", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": null }, "realvuln-lets-be-bad-guys": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 22, "fp": 22, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.9167, "f1": 0.6471, "f2": 0.7857, "f2_score": 78.6, "f3": 0.8462, "f3_score": 84.6, "tpr": 0.9167, "fpr": 0.8462, "youden_j": 0.0705, "cvss_coverage": 1.0, "cvss_tp_weight": 137.9, "cvss_fp_weight": 90.8, "cvss_fn_weight": 15.7, "cvss_precision": 0.603, "cvss_recall": 0.8978, "cvss_f3": 0.856, "cvss_f3_score": 85.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-36" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-016", "file": "badguys/templates/vulnerable/csrf/gift_card.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-023", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-223" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 13, "fp": 1, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.5417, "f1": 0.6842, "f2": 0.5909, "f2_score": 59.1, "f3": 0.5652, "f3_score": 56.5, "tpr": 0.5417, "fpr": 0.2, "youden_j": 0.3417, "cvss_coverage": 1.0, "cvss_tp_weight": 87.9, "cvss_fp_weight": 0.5, "cvss_fn_weight": 65.7, "cvss_precision": 0.9943, "cvss_recall": 0.5723, "cvss_f3": 0.5976, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 2, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8926, "recall": 0.6945, "f1": 0.7807, "f2": 0.7265, "f2_score": 72.7, "f3": 0.7101, "f3_score": 71.0, "tpr": 0.6945, "fpr": 0.3333, "youden_j": 0.3611, "cvss_coverage": 1.0, "cvss_tp_weight": 108.1, "cvss_fp_weight": 9.3, "cvss_fn_weight": 45.5, "cvss_precision": 0.9213, "cvss_recall": 0.7038, "cvss_f3": 0.7205, "cvss_f3_score": 72.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 4, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.754, "recall": 0.4584, "f1": 0.5699, "f2": 0.4973, "f2_score": 49.7, "f3": 0.477, "f3_score": 47.7, "tpr": 0.4584, "fpr": 0.4371, "youden_j": 0.0213, "cvss_coverage": 1.0, "cvss_tp_weight": 75.6, "cvss_fp_weight": 20.1, "cvss_fn_weight": 78.0, "cvss_precision": 0.7916, "cvss_recall": 0.4924, "cvss_f3": 0.5117, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.5833, "f1": 0.7, "f2": 0.625, "f2_score": 62.5, "f3": 0.6034, "f3_score": 60.3, "tpr": 0.5833, "fpr": 0.3333, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 90.3, "cvss_fp_weight": 11.0, "cvss_fn_weight": 63.3, "cvss_precision": 0.8917, "cvss_recall": 0.5879, "cvss_f3": 0.6086, "cvss_f3_score": 60.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 1, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.375, "f1": 0.5294, "f2": 0.4245, "f2_score": 42.5, "f3": 0.3982, "f3_score": 39.8, "tpr": 0.375, "fpr": 0.2, "youden_j": 0.175, "cvss_coverage": 1.0, "cvss_tp_weight": 63.5, "cvss_fp_weight": 0.5, "cvss_fn_weight": 90.1, "cvss_precision": 0.9922, "cvss_recall": 0.4134, "cvss_f3": 0.439, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 0, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4167, "f1": 0.5882, "f2": 0.4717, "f2_score": 47.2, "f3": 0.4425, "f3_score": 44.2, "tpr": 0.4167, "fpr": 0.0, "youden_j": 0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 72.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 80.9, "cvss_precision": 1.0, "cvss_recall": 0.4733, "cvss_f3": 0.4996, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 4, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.81, "recall": 0.5833, "f1": 0.6692, "f2": 0.6135, "f2_score": 61.3, "f3": 0.5979, "f3_score": 59.8, "tpr": 0.5833, "fpr": 0.3889, "youden_j": 0.1944, "cvss_coverage": 1.0, "cvss_tp_weight": 96.4, "cvss_fp_weight": 18.6, "cvss_fn_weight": 57.2, "cvss_precision": 0.8543, "cvss_recall": 0.6274, "cvss_f3": 0.6434, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 2, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9007, "recall": 0.625, "f1": 0.7378, "f2": 0.6657, "f2_score": 66.6, "f3": 0.6447, "f3_score": 64.5, "tpr": 0.625, "fpr": 0.2333, "youden_j": 0.3917, "cvss_coverage": 1.0, "cvss_tp_weight": 104.3, "cvss_fp_weight": 7.5, "cvss_fn_weight": 49.3, "cvss_precision": 0.934, "cvss_recall": 0.6793, "cvss_f3": 0.6982, "cvss_f3_score": 69.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 8, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6743, "recall": 0.6528, "f1": 0.6629, "f2": 0.6567, "f2_score": 65.7, "f3": 0.6547, "f3_score": 65.4, "tpr": 0.6528, "fpr": 0.6502, "youden_j": 0.0026, "cvss_coverage": 1.0, "cvss_tp_weight": 101.7, "cvss_fp_weight": 38.7, "cvss_fn_weight": 51.9, "cvss_precision": 0.7285, "cvss_recall": 0.6621, "cvss_f3": 0.6679, "cvss_f3_score": 66.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 9, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6538, "recall": 0.7083, "f1": 0.68, "f2": 0.6967, "f2_score": 69.7, "f3": 0.7025, "f3_score": 70.2, "tpr": 0.7083, "fpr": 0.6923, "youden_j": 0.016, "cvss_coverage": 1.0, "cvss_tp_weight": 114.8, "cvss_fp_weight": 39.4, "cvss_fn_weight": 38.8, "cvss_precision": 0.7445, "cvss_recall": 0.7474, "cvss_f3": 0.7471, "cvss_f3_score": 74.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 2, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8967, "recall": 0.5833, "f1": 0.7062, "f2": 0.6269, "f2_score": 62.7, "f3": 0.6044, "f3_score": 60.4, "tpr": 0.5833, "fpr": 0.2762, "youden_j": 0.3071, "cvss_coverage": 1.0, "cvss_tp_weight": 96.5, "cvss_fp_weight": 7.5, "cvss_fn_weight": 57.1, "cvss_precision": 0.9289, "cvss_recall": 0.6285, "cvss_f3": 0.6494, "cvss_f3_score": 65.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9231, "recall": 0.5, "f1": 0.6486, "f2": 0.5505, "f2_score": 55.0, "f3": 0.524, "f3_score": 52.4, "tpr": 0.5, "fpr": 0.2, "youden_j": 0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 79.9, "cvss_fp_weight": 5.5, "cvss_fn_weight": 73.7, "cvss_precision": 0.9358, "cvss_recall": 0.5202, "cvss_f3": 0.5444, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 24, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 153.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-016", "file": "badguys/templates/vulnerable/csrf/gift_card.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-023", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 2, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.5417, "f1": 0.6667, "f2": 0.5856, "f2_score": 58.6, "f3": 0.5628, "f3_score": 56.3, "tpr": 0.5417, "fpr": 0.3333, "youden_j": 0.2083, "cvss_coverage": 1.0, "cvss_tp_weight": 88.1, "cvss_fp_weight": 6.0, "cvss_fn_weight": 65.5, "cvss_precision": 0.9364, "cvss_recall": 0.5736, "cvss_f3": 0.5967, "cvss_f3_score": 59.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 2, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.5417, "f1": 0.6667, "f2": 0.5856, "f2_score": 58.6, "f3": 0.5628, "f3_score": 56.3, "tpr": 0.5417, "fpr": 0.3333, "youden_j": 0.2083, "cvss_coverage": 1.0, "cvss_tp_weight": 87.1, "cvss_fp_weight": 11.0, "cvss_fn_weight": 66.5, "cvss_precision": 0.8881, "cvss_recall": 0.5671, "cvss_f3": 0.5883, "cvss_f3_score": 58.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 24, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 153.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-016", "file": "badguys/templates/vulnerable/csrf/gift_card.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-023", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 16, "fp": 4, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.786, "recall": 0.6528, "f1": 0.711, "f2": 0.6745, "f2_score": 67.4, "f3": 0.6634, "f3_score": 66.3, "tpr": 0.6528, "fpr": 0.5133, "youden_j": 0.1396, "cvss_coverage": 1.0, "cvss_tp_weight": 104.6, "cvss_fp_weight": 20.4, "cvss_fn_weight": 49.0, "cvss_precision": 0.8372, "cvss_recall": 0.6808, "cvss_f3": 0.6935, "cvss_f3_score": 69.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 1, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9375, "recall": 0.5972, "f1": 0.7289, "f2": 0.6437, "f2_score": 64.4, "f3": 0.6196, "f3_score": 62.0, "tpr": 0.5972, "fpr": 0.1778, "youden_j": 0.4194, "cvss_coverage": 1.0, "cvss_tp_weight": 96.4, "cvss_fp_weight": 3.8, "cvss_fn_weight": 57.2, "cvss_precision": 0.9637, "cvss_recall": 0.6274, "cvss_f3": 0.65, "cvss_f3_score": 65.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 4, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7593, "recall": 0.5555, "f1": 0.6374, "f2": 0.585, "f2_score": 58.5, "f3": 0.5698, "f3_score": 57.0, "tpr": 0.5555, "fpr": 0.5095, "youden_j": 0.046, "cvss_coverage": 1.0, "cvss_tp_weight": 90.4, "cvss_fp_weight": 18.8, "cvss_fn_weight": 63.2, "cvss_precision": 0.8315, "cvss_recall": 0.5883, "cvss_f3": 0.6051, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-99" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 12, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.5, "f1": 0.5854, "f2": 0.531, "f2_score": 53.1, "f3": 0.515, "f3_score": 51.5, "tpr": 0.5, "fpr": 0.5556, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 81.6, "cvss_fp_weight": 27.4, "cvss_fn_weight": 72.0, "cvss_precision": 0.7484, "cvss_recall": 0.5312, "cvss_f3": 0.5471, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 11, "fp": 4, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.4583, "f1": 0.5641, "f2": 0.4955, "f2_score": 49.5, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4583, "fpr": 0.5, "youden_j": -0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 76.0, "cvss_fp_weight": 27.0, "cvss_fn_weight": 77.6, "cvss_precision": 0.7379, "cvss_recall": 0.4948, "cvss_f3": 0.5116, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 17, "fp": 33, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.34, "recall": 0.7083, "f1": 0.4595, "f2": 0.5822, "f2_score": 58.2, "f3": 0.6391, "f3_score": 63.9, "tpr": 0.7083, "fpr": 0.8919, "youden_j": -0.1836, "cvss_coverage": 1.0, "cvss_tp_weight": 112.2, "cvss_fp_weight": 205.0, "cvss_fn_weight": 41.4, "cvss_precision": 0.3537, "cvss_recall": 0.7305, "cvss_f3": 0.6602, "cvss_f3_score": 66.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-441" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/vulnerable/direct_object_references/profile.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/.xss-path.js.swp", "cwe": "CWE-530" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 19, "fp": 13, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5938, "recall": 0.7917, "f1": 0.6786, "f2": 0.7422, "f2_score": 74.2, "f3": 0.7661, "f3_score": 76.6, "tpr": 0.7917, "fpr": 0.7647, "youden_j": 0.027, "cvss_coverage": 1.0, "cvss_tp_weight": 120.6, "cvss_fp_weight": 86.5, "cvss_fn_weight": 33.0, "cvss_precision": 0.5823, "cvss_recall": 0.7852, "cvss_f3": 0.7587, "cvss_f3_score": 75.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-913" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/.xss-path.js.swp", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-016", "file": "badguys/templates/vulnerable/csrf/gift_card.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/vulnerable/direct_object_references/profile.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 1, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0417, "f1": 0.0769, "f2": 0.051, "f2_score": 5.1, "f3": 0.0459, "f3_score": 4.6, "tpr": 0.0417, "fpr": 0.2, "youden_j": -0.1583, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 8.0, "cvss_fn_weight": 144.5, "cvss_precision": 0.5322, "cvss_recall": 0.0592, "cvss_f3": 0.065, "cvss_f3_score": 6.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 20, "fp": 25, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.8333, "f1": 0.5797, "f2": 0.7092, "f2_score": 70.9, "f3": 0.7663, "f3_score": 76.6, "tpr": 0.8333, "fpr": 0.8621, "youden_j": -0.0287, "cvss_coverage": 1.0, "cvss_tp_weight": 128.1, "cvss_fp_weight": 195.5, "cvss_fn_weight": 25.5, "cvss_precision": 0.3959, "cvss_recall": 0.834, "cvss_f3": 0.7509, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.section.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.section.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/exercise_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-749" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 20, "fp": 13, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6061, "recall": 0.8333, "f1": 0.7018, "f2": 0.7752, "f2_score": 77.5, "f3": 0.8032, "f3_score": 80.3, "tpr": 0.8333, "fpr": 0.7647, "youden_j": 0.0686, "cvss_coverage": 1.0, "cvss_tp_weight": 130.0, "cvss_fp_weight": 104.0, "cvss_fn_weight": 23.6, "cvss_precision": 0.5556, "cvss_recall": 0.8464, "cvss_f3": 0.8043, "cvss_f3_score": 80.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-form.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-form.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-form.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-path.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-query.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-023", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 5, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.6667, "f1": 0.7111, "f2": 0.6838, "f2_score": 68.4, "f3": 0.6751, "f3_score": 67.5, "tpr": 0.6667, "fpr": 0.5556, "youden_j": 0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 101.3, "cvss_fp_weight": 37.5, "cvss_fn_weight": 52.3, "cvss_precision": 0.7298, "cvss_recall": 0.6595, "cvss_f3": 0.6659, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-913" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-023", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 20, "fp": 30, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.8333, "f1": 0.5405, "f2": 0.6849, "f2_score": 68.5, "f3": 0.7519, "f3_score": 75.2, "tpr": 0.8333, "fpr": 0.8824, "youden_j": -0.049, "cvss_coverage": 1.0, "cvss_tp_weight": 128.1, "cvss_fp_weight": 222.0, "cvss_fn_weight": 25.5, "cvss_precision": 0.3659, "cvss_recall": 0.834, "cvss_f3": 0.7394, "cvss_f3_score": 73.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-024", "file": "badguys/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-017", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.section.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.section.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/exercise_base.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-018", "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-470" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-749" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6527, "recall": 0.4028, "f1": 0.4972, "f2": 0.4357, "f2_score": 43.6, "f3": 0.4186, "f3_score": 41.9, "tpr": 0.4028, "fpr": 0.5556, "youden_j": -0.1528, "cvss_coverage": 1.0, "cvss_tp_weight": 61.1, "cvss_fp_weight": 25.9, "cvss_fn_weight": 92.5, "cvss_precision": 0.7083, "cvss_recall": 0.3976, "cvss_f3": 0.4157, "cvss_f3_score": 41.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 9, "fp": 5, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.375, "f1": 0.4737, "f2": 0.4091, "f2_score": 40.9, "f3": 0.3913, "f3_score": 39.1, "tpr": 0.375, "fpr": 0.625, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 57.6, "cvss_fp_weight": 27.4, "cvss_fn_weight": 96.0, "cvss_precision": 0.6774, "cvss_recall": 0.375, "cvss_f3": 0.3925, "cvss_f3_score": 39.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 1, "fn": 0, "precision": 0.8, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 6, "fp": 1, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-933" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-933" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-005", "file": "badguys/templates/vulnerable/xss/path.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 9, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5263, "recall": 0.4167, "f1": 0.4651, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4255, "f3_score": 42.6, "tpr": 0.4167, "fpr": 0.6923, "youden_j": -0.2756, "cvss_coverage": 1.0, "cvss_tp_weight": 65.8, "cvss_fp_weight": 44.4, "cvss_fn_weight": 87.8, "cvss_precision": 0.5972, "cvss_recall": 0.4284, "cvss_f3": 0.4408, "cvss_f3_score": 44.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-011", "file": "badguys/vulnerable/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-010", "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-019", "file": "badguys/settings.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 39, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1522, "recall": 0.2917, "f1": 0.2, "f2": 0.2465, "f2_score": 24.6, "f3": 0.2672, "f3_score": 26.7, "tpr": 0.2917, "fpr": 0.907, "youden_j": -0.6153, "cvss_coverage": 1.0, "cvss_tp_weight": 51.4, "cvss_fp_weight": 59.0, "cvss_fn_weight": 102.2, "cvss_precision": 0.4656, "cvss_recall": 0.3346, "cvss_f3": 0.3443, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-012", "file": "badguys/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation/foundation.tooltips.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/foundation.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-014", "file": "badguys/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-path.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/exercises/xss-query.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/custom.modernizr.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/static/js/vendor/jquery.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-009", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 8, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5294, "recall": 0.375, "f1": 0.439, "f2": 0.3982, "f2_score": 39.8, "f3": 0.3863, "f3_score": 38.6, "tpr": 0.375, "fpr": 0.6667, "youden_j": -0.2917, "cvss_coverage": 1.0, "cvss_tp_weight": 65.0, "cvss_fp_weight": 43.9, "cvss_fn_weight": 88.6, "cvss_precision": 0.597, "cvss_recall": 0.4232, "cvss_f3": 0.4359, "cvss_f3_score": 43.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/base.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/base.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/conclusion.html", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-016", "file": "badguys/templates/vulnerable/csrf/gift_card.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/vulnerable/direct_object_references/profile.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-020", "file": "badguys/templates/vulnerable/injection/code_execution.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-021", "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/templates/vulnerable/injection/sql.html", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-022", "file": "badguys/vulnerable/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-015", "file": "badguys/vulnerable/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "badguys/vulnerable/views.py", "cwe": "CWE-96" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-007", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 8, "fp": 1, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.3333, "f1": 0.4848, "f2": 0.381, "f2_score": 38.1, "f3": 0.3556, "f3_score": 35.6, "tpr": 0.3333, "fpr": 0.2, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 59.2, "cvss_fp_weight": 9.5, "cvss_fn_weight": 94.4, "cvss_precision": 0.8617, "cvss_recall": 0.3854, "cvss_f3": 0.408, "cvss_f3_score": 40.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "badguys/settings.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-013", "file": "badguys/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-007", "file": "badguys/templates/vulnerable/csrf/image.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-004", "file": "badguys/templates/vulnerable/xss/form.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-006", "file": "badguys/templates/vulnerable/xss/query.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-001", "file": "badguys/vulnerable/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-002", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-003", "file": "badguys/vulnerable/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "lets-be-bad-guys-008", "file": "badguys/vulnerable/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-016", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-022", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-023", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "lets-be-bad-guys-024", "file": null, "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "lets-be-bad-guys-fp-004", "file": null, "cwe": "CWE-79" } ] } }, "realvuln-nextjs-vulnerable-app": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 1, "fp": 4, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 1.0, "f1": 0.3333, "f2": 0.5556, "f2_score": 55.6, "f3": 0.7143, "f3_score": 71.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 36.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.2, "cvss_recall": 1.0, "cvss_f3": 0.7143, "cvss_f3_score": 71.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 1, "fp": 5, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 1.0, "f1": 0.2857, "f2": 0.5, "f2_score": 50.0, "f3": 0.6667, "f3_score": 66.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 45.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.1667, "cvss_recall": 1.0, "cvss_f3": 0.6667, "cvss_f3_score": 66.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 1, "fp": 4, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 1.0, "f1": 0.3333, "f2": 0.5556, "f2_score": 55.6, "f3": 0.7143, "f3_score": 71.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 36.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.2, "cvss_recall": 1.0, "cvss_f3": 0.7143, "cvss_f3_score": 71.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-16" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 1, "fp": 3, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 1.0, "f1": 0.4, "f2": 0.625, "f2_score": 62.5, "f3": 0.7692, "f3_score": 76.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 27.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.25, "cvss_recall": 1.0, "cvss_f3": 0.7692, "cvss_f3_score": 76.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 1, "fp": 5, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 1.0, "f1": 0.2857, "f2": 0.5, "f2_score": 50.0, "f3": 0.6667, "f3_score": 66.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 36.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.1978, "cvss_recall": 1.0, "cvss_f3": 0.7115, "cvss_f3_score": 71.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-16" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 1, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 9.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.5, "cvss_recall": 1.0, "cvss_f3": 0.9091, "cvss_f3_score": 90.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "pages/dashboard.js", "cwe": "CWE-540" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 1, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 9.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.5, "cvss_recall": 1.0, "cvss_f3": 0.9091, "cvss_f3_score": 90.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "next.config.js", "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nextjs-vulnerable-app-001", "file": "pages/api/auth/[...nextauth].js", "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 0, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 9.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "nextjs-vulnerable-app-001", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "realvuln-ninjasworkout": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 13, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.381, "recall": 0.3636, "f1": 0.3721, "f2": 0.367, "f2_score": 36.7, "f3": 0.3653, "f3_score": 36.5, "tpr": 0.3636, "fpr": 1.0, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 64.1, "cvss_fp_weight": 68.8, "cvss_fn_weight": 84.0, "cvss_precision": 0.4823, "cvss_recall": 0.4328, "cvss_f3": 0.4373, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-009", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-011", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-005", "file": "routers/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/mail.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-012", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-019", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 16, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 0.4091, "f1": 0.383, "f2": 0.3982, "f2_score": 39.8, "f3": 0.4036, "f3_score": 40.4, "tpr": 0.4091, "fpr": 1.0, "youden_j": -0.5909, "cvss_coverage": 1.0, "cvss_tp_weight": 65.8, "cvss_fp_weight": 89.0, "cvss_fn_weight": 82.3, "cvss_precision": 0.425, "cvss_recall": 0.4443, "cvss_f3": 0.4423, "cvss_f3_score": 44.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-005", "file": "routers/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-003", "file": "home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-019", "file": "routers/index.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-004", "file": "public/redirect.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "public/redirect.html", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-010", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 6, "fp": 8, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.2727, "f1": 0.3333, "f2": 0.2941, "f2_score": 29.4, "f3": 0.283, "f3_score": 28.3, "tpr": 0.2727, "fpr": 1.0, "youden_j": -0.7273, "cvss_coverage": 1.0, "cvss_tp_weight": 46.1, "cvss_fp_weight": 41.4, "cvss_fn_weight": 102.0, "cvss_precision": 0.5269, "cvss_recall": 0.3113, "cvss_f3": 0.3246, "cvss_f3_score": 32.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-003", "file": "home.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-012", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-019", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 6, "fp": 17, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2609, "recall": 0.2727, "f1": 0.2667, "f2": 0.2703, "f2_score": 27.0, "f3": 0.2715, "f3_score": 27.1, "tpr": 0.2727, "fpr": 1.0, "youden_j": -0.7273, "cvss_coverage": 1.0, "cvss_tp_weight": 47.5, "cvss_fp_weight": 95.7, "cvss_fn_weight": 100.6, "cvss_precision": 0.3316, "cvss_recall": 0.3207, "cvss_f3": 0.3218, "cvss_f3_score": 32.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/sendemail.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/mail.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "public/hack.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/hack.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/hack.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-019", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 35, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2708, "recall": 0.5909, "f1": 0.3714, "f2": 0.4779, "f2_score": 47.8, "f3": 0.5285, "f3_score": 52.8, "tpr": 0.5909, "fpr": 1.0, "youden_j": -0.4091, "cvss_coverage": 1.0, "cvss_tp_weight": 89.8, "cvss_fp_weight": 210.7, "cvss_fn_weight": 58.3, "cvss_precision": 0.2988, "cvss_recall": 0.6063, "cvss_f3": 0.5498, "cvss_f3_score": 55.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 8, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-009", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-011", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-019", "file": "routers/index.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-014", "file": "routers/index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-003", "file": "home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "public/hack.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-004", "file": "public/redirect.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "views/redirect.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 5, "fp": 28, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1515, "recall": 0.2273, "f1": 0.1818, "f2": 0.2066, "f2_score": 20.7, "f3": 0.2165, "f3_score": 21.6, "tpr": 0.2273, "fpr": 1.0, "youden_j": -0.7727, "cvss_coverage": 1.0, "cvss_tp_weight": 40.0, "cvss_fp_weight": 188.5, "cvss_fn_weight": 108.1, "cvss_precision": 0.1751, "cvss_recall": 0.2701, "cvss_f3": 0.2562, "cvss_f3_score": 25.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 15, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/hack.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/redirect.html", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "views/login.pug", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-178" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-010", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-019", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 8, "fp": 18, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.3636, "f1": 0.3333, "f2": 0.3509, "f2_score": 35.1, "f3": 0.3571, "f3_score": 35.7, "tpr": 0.3636, "fpr": 1.0, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 60.5, "cvss_fp_weight": 108.7, "cvss_fn_weight": 87.6, "cvss_precision": 0.3575, "cvss_recall": 0.4085, "cvss_f3": 0.4028, "cvss_f3_score": 40.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-005", "file": "routers/index.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-011", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-488" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "public/redirect.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "public/redirect.html", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-003", "file": "home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-019", "file": "routers/index.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-367" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-010", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-012", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 25, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.9091, "f1": 0.597, "f2": 0.7519, "f2_score": 75.2, "f3": 0.823, "f3_score": 82.3, "tpr": 0.9091, "fpr": 1.0, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 136.1, "cvss_fp_weight": 168.3, "cvss_fn_weight": 12.0, "cvss_precision": 0.4471, "cvss_recall": 0.919, "cvss_f3": 0.8312, "cvss_f3_score": 83.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 2, "recall": 0.9 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-004", "file": "public/redirect.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-005", "file": "routers/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-006", "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-007", "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-009", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-011", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-014", "file": "routers/index.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-015", "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-016", "file": "routers/index.js", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-017", "file": "routers/index.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-018", "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-019", "file": "routers/index.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-020", "file": "routers/index.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 41, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3167, "recall": 0.8636, "f1": 0.4634, "f2": 0.6419, "f2_score": 64.2, "f3": 0.7364, "f3_score": 73.6, "tpr": 0.8636, "fpr": 1.0, "youden_j": -0.1364, "cvss_coverage": 1.0, "cvss_tp_weight": 128.2, "cvss_fp_weight": 288.0, "cvss_fn_weight": 19.9, "cvss_precision": 0.308, "cvss_recall": 0.8656, "cvss_f3": 0.7329, "cvss_f3_score": 73.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 3, "recall": 0.85 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-003", "file": "home.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-013", "file": "routers/index.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-014", "file": "routers/index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-017", "file": "routers/index.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-019", "file": "routers/index.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-020", "file": "routers/index.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-007", "file": "routers/index.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-006", "file": "routers/index.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-018", "file": "routers/index.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "models/strict.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-005", "file": "routers/index.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-009", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-011", "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 65, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0714, "recall": 0.2273, "f1": 0.1087, "f2": 0.1582, "f2_score": 15.8, "f3": 0.1866, "f3_score": 18.7, "tpr": 0.2273, "fpr": 1.0, "youden_j": -0.7727, "cvss_coverage": 1.0, "cvss_tp_weight": 41.0, "cvss_fp_weight": 380.8, "cvss_fn_weight": 107.1, "cvss_precision": 0.0972, "cvss_recall": 0.2768, "cvss_f3": 0.2337, "cvss_f3_score": 23.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 15, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codacy-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/docker-image.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/docker-image.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/njsscan-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "home.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "proto.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-008", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-010", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-012", "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-021", "file": "routers/index.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "ninjasworkout-022", "file": "routers/index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "routers/index.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-016", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-019", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "ninjasworkout-020", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null }, "realvuln-node-api-goat": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 4, "fp": 6, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.5714, "f1": 0.4706, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5479, "f3_score": 54.8, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 35.5, "cvss_fp_weight": 44.2, "cvss_fn_weight": 25.7, "cvss_precision": 0.4453, "cvss_recall": 0.5801, "cvss_f3": 0.563, "cvss_f3_score": 56.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "node-api-goat-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-005", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 5, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.8571, "f1": 0.6667, "f2": 0.7692, "f2_score": 76.9, "f3": 0.8108, "f3_score": 81.1, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 51.4, "cvss_fp_weight": 43.7, "cvss_fn_weight": 9.8, "cvss_precision": 0.5404, "cvss_recall": 0.8399, "cvss_f3": 0.7958, "cvss_f3_score": 79.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-002", "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 5, "fp": 4, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7143, "f1": 0.625, "f2": 0.6757, "f2_score": 67.6, "f3": 0.6944, "f3_score": 69.4, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 41.6, "cvss_fp_weight": 35.0, "cvss_fn_weight": 19.6, "cvss_precision": 0.5433, "cvss_recall": 0.6797, "cvss_f3": 0.6631, "cvss_f3_score": 66.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "node-api-goat-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 4, "fp": 5, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.5714, "f1": 0.5, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 35.5, "cvss_fp_weight": 35.5, "cvss_fn_weight": 25.7, "cvss_precision": 0.5002, "cvss_recall": 0.5801, "cvss_f3": 0.5709, "cvss_f3_score": 57.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "node-api-goat-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-005", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 6, "fp": 6, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.8571, "f1": 0.6316, "f2": 0.75, "f2_score": 75.0, "f3": 0.8, "f3_score": 80.0, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 44.2, "cvss_fn_weight": 6.1, "cvss_precision": 0.5548, "cvss_recall": 0.9003, "cvss_f3": 0.8475, "cvss_f3_score": 84.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-002", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-003", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "node-api-goat-005", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 5, "fp": 3, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.7143, "f1": 0.6667, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 41.6, "cvss_fp_weight": 18.0, "cvss_fn_weight": 19.6, "cvss_precision": 0.6982, "cvss_recall": 0.6797, "cvss_f3": 0.6815, "cvss_f3_score": 68.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "node-api-goat-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 5, "fp": 7, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.7143, "f1": 0.5263, "f2": 0.625, "f2_score": 62.5, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 41.6, "cvss_fp_weight": 53.0, "cvss_fn_weight": 19.6, "cvss_precision": 0.4399, "cvss_recall": 0.6797, "cvss_f3": 0.6446, "cvss_f3_score": 64.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "azure-pipelines-1.yml", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "test.sh", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "node-api-goat-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "node-api-goat-003", "file": null, "cwe": "CWE-94" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 7, "fp": 3, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 1.0, "f1": 0.8235, "f2": 0.9211, "f2_score": 92.1, "f3": 0.9589, "f3_score": 95.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 61.2, "cvss_fp_weight": 18.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.7729, "cvss_recall": 1.0, "cvss_f3": 0.9715, "cvss_f3_score": 97.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-002", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-003", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 7, "fp": 3, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 1.0, "f1": 0.8235, "f2": 0.9211, "f2_score": 92.1, "f3": 0.9589, "f3_score": 95.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 61.2, "cvss_fp_weight": 24.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.7183, "cvss_recall": 1.0, "cvss_f3": 0.9623, "cvss_f3_score": 96.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "node-api-goat-002", "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "node-api-goat-003", "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "azure-pipelines-1.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "azure-pipelines-1.yml", "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3043, "recall": 1.0, "f1": 0.4667, "f2": 0.6863, "f2_score": 68.6, "f3": 0.814, "f3_score": 81.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 61.2, "cvss_fp_weight": 133.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.3149, "cvss_recall": 1.0, "cvss_f3": 0.8213, "cvss_f3_score": 82.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/semgrep.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/semgrep.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "node-api-goat-001", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-002", "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "node-api-goat-003", "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-004", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "node-api-goat-005", "file": "app/server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "node-api-goat-006", "file": "app/server.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "node-api-goat-007", "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/server.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "start-agent-server.sh", "cwe": "CWE-798" } ] }, "sonarqube": null }, "realvuln-nodegoat": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 6, "fp": 11, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3529, "recall": 0.2143, "f1": 0.2667, "f2": 0.2326, "f2_score": 23.3, "f3": 0.223, "f3_score": 22.3, "tpr": 0.2143, "fpr": 1.0, "youden_j": -0.7857, "cvss_coverage": 1.0, "cvss_tp_weight": 34.5, "cvss_fp_weight": 51.9, "cvss_fn_weight": 141.8, "cvss_precision": 0.3994, "cvss_recall": 0.1957, "cvss_f3": 0.2062, "cvss_f3_score": 20.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 20, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 18, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3793, "recall": 0.3929, "f1": 0.386, "f2": 0.3901, "f2_score": 39.0, "f3": 0.3915, "f3_score": 39.1, "tpr": 0.3929, "fpr": 1.0, "youden_j": -0.6071, "cvss_coverage": 1.0, "cvss_tp_weight": 68.8, "cvss_fp_weight": 95.9, "cvss_fn_weight": 107.5, "cvss_precision": 0.4176, "cvss_recall": 0.3902, "cvss_f3": 0.3928, "cvss_f3_score": 39.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 15, "recall": 0.4231 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-006", "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodegoat-001", "file": "app/data/allocations-dao.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/allocations.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/layout.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/layout.html", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 9, "fp": 13, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4091, "recall": 0.3214, "f1": 0.36, "f2": 0.3358, "f2_score": 33.6, "f3": 0.3285, "f3_score": 32.8, "tpr": 0.3214, "fpr": 1.0, "youden_j": -0.6786, "cvss_coverage": 1.0, "cvss_tp_weight": 53.6, "cvss_fp_weight": 64.5, "cvss_fn_weight": 122.7, "cvss_precision": 0.454, "cvss_recall": 0.304, "cvss_f3": 0.3144, "cvss_f3_score": 31.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 17, "recall": 0.3462 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-026", "file": "config/env/development.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 12, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.2857, "f1": 0.3333, "f2": 0.303, "f2_score": 30.3, "f3": 0.2941, "f3_score": 29.4, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 47.0, "cvss_fp_weight": 64.0, "cvss_fn_weight": 129.3, "cvss_precision": 0.4236, "cvss_recall": 0.2666, "cvss_f3": 0.2769, "cvss_f3_score": 27.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 18, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodegoat-009", "file": "app/routes/profile.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-027", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 16, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4483, "recall": 0.4643, "f1": 0.4561, "f2": 0.461, "f2_score": 46.1, "f3": 0.4626, "f3_score": 46.3, "tpr": 0.4643, "fpr": 1.0, "youden_j": -0.5357, "cvss_coverage": 1.0, "cvss_tp_weight": 81.5, "cvss_fp_weight": 89.2, "cvss_fn_weight": 94.8, "cvss_precision": 0.4776, "cvss_recall": 0.4623, "cvss_f3": 0.4638, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 13, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodegoat-006", "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/memos.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-015", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-009", "file": "app/routes/profile.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 21, "fp": 14, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.75, "f1": 0.6667, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7317, "f3_score": 73.2, "tpr": 0.75, "fpr": 1.0, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 124.0, "cvss_fp_weight": 82.4, "cvss_fn_weight": 52.3, "cvss_precision": 0.6009, "cvss_recall": 0.7033, "cvss_f3": 0.6916, "cvss_f3_score": 69.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 6, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodegoat-005", "file": "app/routes/benefits.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/research.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-011", "file": "app/routes/session.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodegoat-002", "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-025", "file": "config/env/all.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodegoat-026", "file": "config/env/development.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodegoat-028", "file": "server.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "nodegoat-017", "file": "app/views/error-template.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "nodegoat-014", "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-015", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-016", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-019", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/benefits.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/memos.js", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 18, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 0.5714, "f1": 0.5161, "f2": 0.5479, "f2_score": 54.8, "f3": 0.5594, "f3_score": 55.9, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 97.1, "cvss_fp_weight": 113.3, "cvss_fn_weight": 79.2, "cvss_precision": 0.4614, "cvss_recall": 0.5508, "cvss_f3": 0.5403, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 11, "recall": 0.5769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-019", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-015", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/research.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodegoat-007", "file": "app/routes/index.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "nodegoat-025", "file": "config/env/all.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "nodegoat-011", "file": "app/routes/session.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/error.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/memos-dao.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "nodegoat-026", "file": "config/env/development.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 14, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.7857, "f1": 0.6875, "f2": 0.7432, "f2_score": 74.3, "f3": 0.7639, "f3_score": 76.4, "tpr": 0.7857, "fpr": 1.0, "youden_j": -0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 131.4, "cvss_fp_weight": 82.4, "cvss_fn_weight": 44.9, "cvss_precision": 0.6147, "cvss_recall": 0.7453, "cvss_f3": 0.7298, "cvss_f3_score": 73.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 5, "recall": 0.8077 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/data/allocations-dao.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodegoat-005", "file": "app/routes/benefits.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/research.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "nodegoat-011", "file": "app/routes/session.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodegoat-002", "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-025", "file": "config/env/all.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodegoat-026", "file": "config/env/development.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodegoat-028", "file": "server.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "nodegoat-017", "file": "app/views/error-template.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "nodegoat-014", "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-015", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-016", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-019", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/benefits.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/memos.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodegoat-022", "file": "artifacts/cert/server.key", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-024", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 39, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3906, "recall": 0.8929, "f1": 0.5435, "f2": 0.7102, "f2_score": 71.0, "f3": 0.7911, "f3_score": 79.1, "tpr": 0.8929, "fpr": 1.0, "youden_j": -0.1071, "cvss_coverage": 1.0, "cvss_tp_weight": 159.7, "cvss_fp_weight": 304.5, "cvss_fn_weight": 16.6, "cvss_precision": 0.344, "cvss_recall": 0.9058, "cvss_f3": 0.7787, "cvss_f3_score": 77.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 2, "recall": 0.9231 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodegoat-001", "file": "app/data/allocations-dao.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodegoat-002", "file": "app/data/profile-dao.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "nodegoat-003", "file": "app/data/user-dao.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/data/user-dao.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "nodegoat-004", "file": "app/routes/allocations.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodegoat-005", "file": "app/routes/benefits.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodegoat-006", "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "nodegoat-011", "file": "app/routes/session.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "nodegoat-013", "file": "app/routes/session.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodegoat-014", "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/allocations.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-015", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-016", "file": "app/views/benefits.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/contributions.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-017", "file": "app/views/error-template.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/error-template.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/layout.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/layout.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-018", "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/login.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/memos.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-019", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-020", "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodegoat-021", "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/signup.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/layout.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/development.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/session.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodegoat-027", "file": "server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodegoat-009", "file": "app/routes/profile.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "nodegoat-022", "file": "artifacts/cert/server.key", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-024", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-025", "file": "config/env/all.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/env/all.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "test/security/profile-test.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 42, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.125, "recall": 0.2143, "f1": 0.1579, "f2": 0.1875, "f2_score": 18.8, "f3": 0.2, "f3_score": 20.0, "tpr": 0.2143, "fpr": 1.0, "youden_j": -0.7857, "cvss_coverage": 1.0, "cvss_tp_weight": 42.9, "cvss_fp_weight": 265.1, "cvss_fn_weight": 133.4, "cvss_precision": 0.1393, "cvss_recall": 0.2433, "cvss_f3": 0.2264, "cvss_f3_score": 22.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 20, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/e2e-test.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/lint.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/lint.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/lint.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/lint.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "nodegoat-006", "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/contributions.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodegoat-008", "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodegoat-010", "file": "app/routes/research.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "nodegoat-012", "file": "app/routes/session.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/benefits.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/memos.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/a2.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/a2.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/a2.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/a5.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/views/tutorial/a5.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "artifacts/cert/server.key", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-023", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodegoat-024", "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "artifacts/db-reset.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "nodegoat-001", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "nodegoat-002", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "nodegoat-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodegoat-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "nodegoat-007", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodegoat-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodegoat-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "nodegoat-013", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "nodegoat-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodegoat-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-019", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodegoat-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodegoat-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodegoat-027", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodegoat-028", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null }, "realvuln-nodejs-goof": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 8, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.4118, "f1": 0.4375, "f2": 0.4217, "f2_score": 42.2, "f3": 0.4167, "f3_score": 41.7, "tpr": 0.4118, "fpr": 1.0, "youden_j": -0.5882, "cvss_coverage": 1.0, "cvss_tp_weight": 55.5, "cvss_fp_weight": 40.3, "cvss_fn_weight": 76.3, "cvss_precision": 0.5795, "cvss_recall": 0.4211, "cvss_f3": 0.4329, "cvss_f3_score": 43.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-017", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 15, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3182, "recall": 0.4118, "f1": 0.359, "f2": 0.3889, "f2_score": 38.9, "f3": 0.4, "f3_score": 40.0, "tpr": 0.4118, "fpr": 1.0, "youden_j": -0.5882, "cvss_coverage": 1.0, "cvss_tp_weight": 59.5, "cvss_fp_weight": 87.3, "cvss_fn_weight": 72.3, "cvss_precision": 0.4054, "cvss_recall": 0.4514, "cvss_f3": 0.4464, "cvss_f3_score": 44.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 5, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.4706, "f1": 0.5333, "f2": 0.4938, "f2_score": 49.4, "f3": 0.4819, "f3_score": 48.2, "tpr": 0.4706, "fpr": 1.0, "youden_j": -0.5294, "cvss_coverage": 1.0, "cvss_tp_weight": 63.8, "cvss_fp_weight": 24.3, "cvss_fn_weight": 68.0, "cvss_precision": 0.7245, "cvss_recall": 0.4841, "cvss_f3": 0.5007, "cvss_f3_score": 50.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-547" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 7, "fp": 11, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 0.4118, "f1": 0.4, "f2": 0.407, "f2_score": 40.7, "f3": 0.4094, "f3_score": 40.9, "tpr": 0.4118, "fpr": 1.0, "youden_j": -0.5882, "cvss_coverage": 1.0, "cvss_tp_weight": 56.3, "cvss_fp_weight": 78.0, "cvss_fn_weight": 75.5, "cvss_precision": 0.4191, "cvss_recall": 0.4272, "cvss_f3": 0.4263, "cvss_f3_score": 42.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 11, "fp": 19, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3667, "recall": 0.6471, "f1": 0.4681, "f2": 0.5612, "f2_score": 56.1, "f3": 0.6011, "f3_score": 60.1, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 80.9, "cvss_fp_weight": 111.0, "cvss_fn_weight": 50.9, "cvss_precision": 0.4215, "cvss_recall": 0.6138, "cvss_f3": 0.587, "cvss_f3_score": 58.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-471" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-012", "file": "routes/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 12, "fp": 20, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.7059, "f1": 0.4898, "f2": 0.6, "f2_score": 60.0, "f3": 0.6486, "f3_score": 64.9, "tpr": 0.7059, "fpr": 1.0, "youden_j": -0.2941, "cvss_coverage": 1.0, "cvss_tp_weight": 90.0, "cvss_fp_weight": 140.6, "cvss_fn_weight": 41.8, "cvss_precision": 0.3904, "cvss_recall": 0.6829, "cvss_f3": 0.6353, "cvss_f3_score": 63.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "views/about_new.dust", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-012", "file": "routes/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 14, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.6471, "f1": 0.5238, "f2": 0.5914, "f2_score": 59.1, "f3": 0.618, "f3_score": 61.8, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 81.9, "cvss_fp_weight": 108.5, "cvss_fn_weight": 49.9, "cvss_precision": 0.4301, "cvss_recall": 0.6214, "cvss_f3": 0.5949, "cvss_f3_score": 59.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-012", "file": "routes/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-013", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 9, "fp": 13, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4091, "recall": 0.5294, "f1": 0.4615, "f2": 0.5, "f2_score": 50.0, "f3": 0.5143, "f3_score": 51.4, "tpr": 0.5294, "fpr": 1.0, "youden_j": -0.4706, "cvss_coverage": 1.0, "cvss_tp_weight": 66.3, "cvss_fp_weight": 93.5, "cvss_fn_weight": 65.5, "cvss_precision": 0.4148, "cvss_recall": 0.503, "cvss_f3": 0.4926, "cvss_f3_score": 49.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "mongoose-db.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-013", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 14, "fp": 17, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4516, "recall": 0.8235, "f1": 0.5833, "f2": 0.7071, "f2_score": 70.7, "f3": 0.7609, "f3_score": 76.1, "tpr": 0.8235, "fpr": 1.0, "youden_j": -0.1765, "cvss_coverage": 1.0, "cvss_tp_weight": 109.6, "cvss_fp_weight": 131.0, "cvss_fn_weight": 22.2, "cvss_precision": 0.4555, "cvss_recall": 0.8316, "cvss_f3": 0.7682, "cvss_f3_score": 76.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-008", "file": "routes/index.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-009", "file": "routes/index.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-013", "file": "routes/index.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "typeorm-db.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-016", "file": "views/about_new.dust", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-004", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-005", "file": "mongoose-db.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-015", "file": "typeorm-db.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-014", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 41, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0682, "recall": 0.1765, "f1": 0.0984, "f2": 0.1339, "f2_score": 13.4, "f3": 0.1523, "f3_score": 15.2, "tpr": 0.1765, "fpr": 1.0, "youden_j": -0.8235, "cvss_coverage": 1.0, "cvss_tp_weight": 25.0, "cvss_fp_weight": 314.1, "cvss_fn_weight": 106.8, "cvss_precision": 0.0737, "cvss_recall": 0.1897, "cvss_f3": 0.1639, "cvss_f3_score": 16.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/codeql-analysis.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code-manual.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code-manual.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code-manual.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code-manual.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-code.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/snyk-test-sarif.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-007", "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-010", "file": "routes/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "nodejs-goof-017", "file": "views/admin.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.hbs", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-013", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "nodejs-goof-016", "file": null, "cwe": "CWE-1336" } ] }, "sonarqube": null }, "realvuln-oss-oopssec-store": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 60, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.2, "recall": 0.375, "f1": 0.2609, "f2": 0.3191, "f2_score": 31.9, "f3": 0.3448, "f3_score": 34.5, "tpr": 0.375, "fpr": 1.0, "youden_j": -0.625, "cvss_coverage": 1.0, "cvss_tp_weight": 97.5, "cvss_fp_weight": 377.7, "cvss_fn_weight": 166.5, "cvss_precision": 0.2052, "cvss_recall": 0.3693, "cvss_f3": 0.342, "cvss_f3_score": 34.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 24, "recall": 0.3846 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-040", "file": "lib/server-auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-033", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-041", "file": "lib/share-crypto.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/diag/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/tracking/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-019", "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/coupon/apply/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/prompt-injection-filter.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/mcp/route.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-011", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/ai-assistant/AIAssistantChat.tsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-004", "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/gift-card.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/gift-card.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/redeem/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/hints/reveal/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lab/quarantine/productivity-helper.mdc", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lab/quarantine/productivity-helper.mdc", "cwe": "CWE-506" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/react-toastfy/package.json", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/react-toastfy/scripts/postinstall.js", "cwe": "CWE-506" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-014", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-029", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-031", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-037", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 0, "fp": 0, "fn": 40, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 264.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 39, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-014", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-029", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-031", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-037", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-039", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-041", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 18, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.4706, "recall": 0.4, "f1": 0.4324, "f2": 0.4124, "f2_score": 41.2, "f3": 0.4061, "f3_score": 40.6, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 118.8, "cvss_fn_weight": 162.0, "cvss_precision": 0.462, "cvss_recall": 0.3864, "cvss_f3": 0.3928, "cvss_f3_score": 39.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 24, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-027", "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-033", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/gift-card.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-026", "file": "app/api/orders/route.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/live-stream.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/mcp-constants.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-014", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-041", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 11, "fp": 34, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.2444, "recall": 0.275, "f1": 0.2588, "f2": 0.2683, "f2_score": 26.8, "f3": 0.2716, "f3_score": 27.2, "tpr": 0.275, "fpr": 1.0, "youden_j": -0.725, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 224.4, "cvss_fn_weight": 194.4, "cvss_precision": 0.2367, "cvss_recall": 0.2636, "cvss_f3": 0.2607, "cvss_f3_score": 26.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 28, "recall": 0.2821 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/gift-card.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/products/[id]/reviews/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/live-stream.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/mcp-constants.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/checkout/CheckoutClient.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-014", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-029", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-041", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 32, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.3725, "recall": 0.475, "f1": 0.4176, "f2": 0.4502, "f2_score": 45.0, "f3": 0.4623, "f3_score": 46.2, "tpr": 0.475, "fpr": 1.0, "youden_j": -0.525, "cvss_coverage": 1.0, "cvss_tp_weight": 121.7, "cvss_fp_weight": 211.2, "cvss_fn_weight": 142.3, "cvss_precision": 0.3656, "cvss_recall": 0.461, "cvss_f3": 0.4493, "cvss_f3_score": 44.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 21, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-027", "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-019", "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/uploads/[...path]/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-033", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/internal/page.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/documents/share/route.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/mcp/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/live-stream.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-001", "file": ".env.local", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/checkout/CheckoutClient.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/[slug]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/share/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-014", "file": "app/api/auth/login/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-026", "file": "app/api/orders/route.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-74" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-041", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 17, "fp": 34, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.3333, "recall": 0.425, "f1": 0.3736, "f2": 0.4028, "f2_score": 40.3, "f3": 0.4136, "f3_score": 41.4, "tpr": 0.425, "fpr": 1.0, "youden_j": -0.575, "cvss_coverage": 1.0, "cvss_tp_weight": 111.0, "cvss_fp_weight": 212.2, "cvss_fn_weight": 153.0, "cvss_precision": 0.3434, "cvss_recall": 0.4205, "cvss_f3": 0.4112, "cvss_f3_score": 41.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 23, "recall": 0.4103 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/checkout/CheckoutClient.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-040", "file": "lib/server-auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/validation/schemas/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-026", "file": "app/api/orders/route.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/support/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-014", "file": "app/api/auth/login/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-041", "file": "lib/share-crypto.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-011", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/ai-assistant/AIAssistantChat.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/mcp-constants.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/[slug]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/vulnerabilities/[slug]/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 23, "fp": 43, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.3485, "recall": 0.575, "f1": 0.434, "f2": 0.5088, "f2_score": 50.9, "f3": 0.5399, "f3_score": 54.0, "tpr": 0.575, "fpr": 1.0, "youden_j": -0.425, "cvss_coverage": 1.0, "cvss_tp_weight": 157.5, "cvss_fp_weight": 265.5, "cvss_fn_weight": 106.5, "cvss_precision": 0.3723, "cvss_recall": 0.5966, "cvss_f3": 0.5627, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5385 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 17, "recall": 0.5641 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-040", "file": "lib/server-auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/validation/schemas/auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/reset-password/route.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-033", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-013", "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-014", "file": "app/api/auth/login/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/mcp-constants.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/internal/page.tsx", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/login/LoginForm.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-009", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-497" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-041", "file": "lib/share-crypto.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-018", "file": "app/api/documents/share/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-026", "file": "app/api/orders/route.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/gift-card.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/route.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/redeem/route.ts", "cwe": "CWE-407" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/flags/page.tsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/vulnerabilities/[slug]/page.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-038", "file": "app/news/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/checkout/CheckoutClient.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/support/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/validation/schemas/gift-cards.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 34, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.3704, "recall": 0.5, "f1": 0.4255, "f2": 0.4673, "f2_score": 46.7, "f3": 0.4831, "f3_score": 48.3, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 137.7, "cvss_fp_weight": 218.3, "cvss_fn_weight": 126.3, "cvss_precision": 0.3868, "cvss_recall": 0.5216, "cvss_f3": 0.504, "cvss_f3_score": 50.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4615 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 19, "recall": 0.5128 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-040", "file": "lib/server-auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-003", "file": "app/api/admin/diag/route.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/logs/route.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-014", "file": "app/api/auth/login/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/forgot-password/route.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/support-login/route.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/checkout/CheckoutClient.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-472" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/route.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/profile/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/gift-cards/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-crypto.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-041", "file": "lib/share-crypto.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-018", "file": "app/api/documents/share/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-009", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-010", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-011", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/mcp-constants.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/ai-assistant/AIAssistantChat.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/[slug]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/internal/page.tsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/live-stream.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/admin/documents/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 35, "fp": 48, "fn": 5, "tn": 0, "ns": 1, "ns_gt": 6, "precision": 0.4217, "recall": 0.875, "f1": 0.5691, "f2": 0.7202, "f2_score": 72.0, "f3": 0.7901, "f3_score": 79.0, "tpr": 0.875, "fpr": 1.0, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 229.5, "cvss_fp_weight": 381.5, "cvss_fn_weight": 34.5, "cvss_precision": 0.3756, "cvss_recall": 0.8693, "cvss_f3": 0.7683, "cvss_f3_score": 76.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8462 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 4, "recall": 0.8974 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-002", "file": "app/admin/analytics/AnalyticsClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/admin/reviews/ReviewsClient.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/diag/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-004", "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-005", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-006", "file": "app/api/admin/reviews/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-007", "file": "app/api/admin/suppliers/import-order/route.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/suppliers/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/support-audit/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-008", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-009", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-010", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-011", "file": "app/api/ai-assistant/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-012", "file": "app/api/auth/login/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-014", "file": "app/api/auth/login/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-013", "file": "app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/login/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-016", "file": "app/api/auth/reset-password/route.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/reset-password/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-018", "file": "app/api/documents/share/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/documents/share/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-019", "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-020", "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/live/stream/route.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-025", "file": "app/api/orders/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-027", "file": "app/api/orders/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-029", "file": "app/api/products/search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-030", "file": "app/api/support/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-031", "file": "app/api/tracking/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-033", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-034", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-035", "file": "app/api/user/support-access/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-036", "file": "app/api/wishlists/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-037", "file": "app/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-038", "file": "app/news/page.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-039", "file": "app/products/[id]/ProductDetailClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/profile/ProfileClient.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support/SupportForm.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/server-auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/api.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-015", "file": "app/api/auth/logout/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/user/support-access/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/auth/signup/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "middleware.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-001", "file": ".env.local", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/deploy-docs.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-024", "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/monitoring/auth/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/aes-cbc-padding-oracle.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/aes-cbc-padding-oracle.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/aes-cbc-padding-oracle.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/aes-cbc-padding-oracle.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/insecure-randomness-gift-card.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/public-env-variable.cy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-040", "file": "lib/server-auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-041", "file": "lib/share-crypto.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/api.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/api.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/api.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/api.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/flags.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/flags.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/flags.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/helpers/flags.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-021", "file": "app/api/flags/[slug]/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/count/route.ts", "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": "app/api/flags/progress/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-023", "file": "app/api/flags/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/flags/verify/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/hints/reveal/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/mcp/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 15, "fn": 38, "tn": 0, "ns": 0, "ns_gt": 6, "precision": 0.1176, "recall": 0.05, "f1": 0.0702, "f2": 0.0565, "f2_score": 5.6, "f3": 0.0531, "f3_score": 5.3, "tpr": 0.05, "fpr": 1.0, "youden_j": -0.95, "cvss_coverage": 1.0, "cvss_tp_weight": 14.4, "cvss_fp_weight": 97.9, "cvss_fn_weight": 249.6, "cvss_precision": 0.1282, "cvss_recall": 0.0545, "cvss_f3": 0.0579, "cvss_f3_score": 5.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 37, "recall": 0.0513 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "oss-oopssec-store-001", "file": ".env.local", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/dependabot.yml", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/admin/products/[id]/image/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "oss-oopssec-store-019", "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/vulnerabilities/[slug]/page.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "cypress/e2e/public-env-variable.cy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docs/src/data/blog/jwt-weak-secret-admin-bypass.md", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/invoice.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/create-oss-store/src/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/create-oss-store/src/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/create-oss-store/src/index.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/create-oss-store/src/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "packages/create-oss-store/src/index.js", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-004", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-009", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-010", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-014", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-017", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-018", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-021", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-023", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-027", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-029", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-031", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-034", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-036", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-037", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-038", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-039", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-041", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "oss-oopssec-store-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-022", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-045", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "oss-oopssec-store-046", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "realvuln-owasp-web-playground": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 8, "fn": 8, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.6154, "youden_j": 0.0989, "cvss_coverage": 1.0, "cvss_tp_weight": 136.0, "cvss_fp_weight": 42.7, "cvss_fn_weight": 45.3, "cvss_precision": 0.7612, "cvss_recall": 0.7501, "cvss_f3": 0.7512, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 5, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5357, "f1": 0.625, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5515, "f3_score": 55.1, "tpr": 0.5357, "fpr": 0.5, "youden_j": 0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 110.5, "cvss_fp_weight": 26.7, "cvss_fn_weight": 70.8, "cvss_precision": 0.8056, "cvss_recall": 0.6095, "cvss_f3": 0.6247, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 8, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6524, "recall": 0.5595, "f1": 0.6022, "f2": 0.5758, "f2_score": 57.6, "f3": 0.5676, "f3_score": 56.7, "tpr": 0.5595, "fpr": 0.6099, "youden_j": -0.0504, "cvss_coverage": 1.0, "cvss_tp_weight": 108.4, "cvss_fp_weight": 36.4, "cvss_fn_weight": 72.9, "cvss_precision": 0.7498, "cvss_recall": 0.5977, "cvss_f3": 0.6099, "cvss_f3_score": 61.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 4, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7745, "recall": 0.5238, "f1": 0.6241, "f2": 0.5597, "f2_score": 56.0, "f3": 0.5411, "f3_score": 54.1, "tpr": 0.5238, "fpr": 0.455, "youden_j": 0.0688, "cvss_coverage": 1.0, "cvss_tp_weight": 103.7, "cvss_fp_weight": 23.1, "cvss_fn_weight": 77.6, "cvss_precision": 0.8189, "cvss_recall": 0.5722, "cvss_f3": 0.5898, "cvss_f3_score": 59.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/hackable/passwords.txt", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 28, "fn": 4, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.8571, "f1": 0.6, "f2": 0.7317, "f2_score": 73.2, "f3": 0.7895, "f3_score": 78.9, "tpr": 0.8571, "fpr": 0.8235, "youden_j": 0.0336, "cvss_coverage": 1.0, "cvss_tp_weight": 157.7, "cvss_fp_weight": 125.1, "cvss_fn_weight": 23.6, "cvss_precision": 0.5576, "cvss_recall": 0.8698, "cvss_f3": 0.8237, "cvss_f3_score": 82.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-754" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8709, "recall": 0.4821, "f1": 0.6205, "f2": 0.5293, "f2_score": 53.0, "f3": 0.5047, "f3_score": 50.5, "tpr": 0.4821, "fpr": 0.2857, "youden_j": 0.1965, "cvss_coverage": 1.0, "cvss_tp_weight": 95.3, "cvss_fp_weight": 10.7, "cvss_fn_weight": 86.0, "cvss_precision": 0.8993, "cvss_recall": 0.5259, "cvss_f3": 0.5486, "cvss_f3_score": 54.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 2, "recall": 0.8 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-016", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 3, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.3571, "f1": 0.4878, "f2": 0.4, "f2_score": 40.0, "f3": 0.3774, "f3_score": 37.7, "tpr": 0.3571, "fpr": 0.375, "youden_j": -0.0179, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 16.0, "cvss_fn_weight": 106.8, "cvss_precision": 0.8232, "cvss_recall": 0.4109, "cvss_f3": 0.4326, "cvss_f3_score": 43.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 1, "fn": 3, "recall": 0.7 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-016", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 4, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.791, "recall": 0.4881, "f1": 0.5997, "f2": 0.5269, "f2_score": 52.7, "f3": 0.5067, "f3_score": 50.7, "tpr": 0.4881, "fpr": 0.3902, "youden_j": 0.0979, "cvss_coverage": 1.0, "cvss_tp_weight": 98.6, "cvss_fp_weight": 18.1, "cvss_fn_weight": 82.7, "cvss_precision": 0.8518, "cvss_recall": 0.5441, "cvss_f3": 0.564, "cvss_f3_score": 56.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 18, "fp": 7, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7275, "recall": 0.6548, "f1": 0.685, "f2": 0.6656, "f2_score": 66.5, "f3": 0.66, "f3_score": 66.0, "tpr": 0.6548, "fpr": 0.5505, "youden_j": 0.1043, "cvss_coverage": 1.0, "cvss_tp_weight": 126.6, "cvss_fp_weight": 37.5, "cvss_fn_weight": 54.7, "cvss_precision": 0.7845, "cvss_recall": 0.6981, "cvss_f3": 0.7044, "cvss_f3_score": 70.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dom_xss.html", "cwe": "CWE-87" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 19, "fp": 7, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.74, "recall": 0.6786, "f1": 0.7029, "f2": 0.687, "f2_score": 68.7, "f3": 0.6826, "f3_score": 68.2, "tpr": 0.6786, "fpr": 0.5476, "youden_j": 0.131, "cvss_coverage": 1.0, "cvss_tp_weight": 131.1, "cvss_fp_weight": 39.1, "cvss_fn_weight": 50.2, "cvss_precision": 0.7847, "cvss_recall": 0.7231, "cvss_f3": 0.7273, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-018", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 25, "fp": 27, "fn": 3, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4808, "recall": 0.8929, "f1": 0.625, "f2": 0.7622, "f2_score": 76.2, "f3": 0.8224, "f3_score": 82.2, "tpr": 0.8929, "fpr": 0.8182, "youden_j": 0.0747, "cvss_coverage": 1.0, "cvss_tp_weight": 164.2, "cvss_fp_weight": 139.1, "cvss_fn_weight": 17.1, "cvss_precision": 0.5413, "cvss_recall": 0.9057, "cvss_f3": 0.8486, "cvss_f3_score": 84.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-754" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 2, "fn": 12, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8684, "recall": 0.5893, "f1": 0.7022, "f2": 0.6298, "f2_score": 63.0, "f3": 0.6089, "f3_score": 60.9, "tpr": 0.5893, "fpr": 0.2916, "youden_j": 0.2976, "cvss_coverage": 1.0, "cvss_tp_weight": 115.1, "cvss_fp_weight": 10.9, "cvss_fn_weight": 66.2, "cvss_precision": 0.9136, "cvss_recall": 0.6348, "cvss_f3": 0.6548, "cvss_f3_score": 65.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 4, "fn": 16, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4286, "f1": 0.5455, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4478, "f3_score": 44.8, "tpr": 0.4286, "fpr": 0.4, "youden_j": 0.0286, "cvss_coverage": 1.0, "cvss_tp_weight": 94.3, "cvss_fp_weight": 16.5, "cvss_fn_weight": 87.0, "cvss_precision": 0.8511, "cvss_recall": 0.5201, "cvss_f3": 0.5412, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 18, "fp": 7, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.72, "recall": 0.6429, "f1": 0.6792, "f2": 0.6569, "f2_score": 65.7, "f3": 0.6498, "f3_score": 65.0, "tpr": 0.6429, "fpr": 0.5385, "youden_j": 0.1044, "cvss_coverage": 1.0, "cvss_tp_weight": 122.7, "cvss_fp_weight": 37.3, "cvss_fn_weight": 58.6, "cvss_precision": 0.7667, "cvss_recall": 0.6768, "cvss_f3": 0.6848, "cvss_f3_score": 68.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 0, "fn": 15, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4643, "f1": 0.6341, "f2": 0.52, "f2_score": 52.0, "f3": 0.4906, "f3_score": 49.1, "tpr": 0.4643, "fpr": 0.0, "youden_j": 0.4643, "cvss_coverage": 1.0, "cvss_tp_weight": 95.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 85.4, "cvss_precision": 1.0, "cvss_recall": 0.529, "cvss_f3": 0.5551, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 7, "fn": 13, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.5357, "f1": 0.6, "f2": 0.5597, "f2_score": 56.0, "f3": 0.5474, "f3_score": 54.7, "tpr": 0.5357, "fpr": 0.5385, "youden_j": -0.0027, "cvss_coverage": 1.0, "cvss_tp_weight": 108.3, "cvss_fp_weight": 32.5, "cvss_fn_weight": 73.0, "cvss_precision": 0.7692, "cvss_recall": 0.5974, "cvss_f3": 0.611, "cvss_f3_score": 61.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 18, "fp": 10, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.6429, "f1": 0.6429, "f2": 0.6429, "f2_score": 64.3, "f3": 0.6429, "f3_score": 64.3, "tpr": 0.6429, "fpr": 0.625, "youden_j": 0.0179, "cvss_coverage": 1.0, "cvss_tp_weight": 122.7, "cvss_fp_weight": 48.5, "cvss_fn_weight": 58.6, "cvss_precision": 0.7167, "cvss_recall": 0.6768, "cvss_f3": 0.6806, "cvss_f3_score": 68.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 7, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6797, "recall": 0.4286, "f1": 0.5111, "f2": 0.4561, "f2_score": 45.6, "f3": 0.4416, "f3_score": 44.2, "tpr": 0.4286, "fpr": 0.5212, "youden_j": -0.0926, "cvss_coverage": 1.0, "cvss_tp_weight": 87.9, "cvss_fp_weight": 34.1, "cvss_fn_weight": 93.4, "cvss_precision": 0.756, "cvss_recall": 0.4848, "cvss_f3": 0.5001, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 1, "recall": 0.9 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 16, "fp": 7, "fn": 12, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7149, "recall": 0.5833, "f1": 0.6403, "f2": 0.6045, "f2_score": 60.5, "f3": 0.5936, "f3_score": 59.4, "tpr": 0.5833, "fpr": 0.5074, "youden_j": 0.0759, "cvss_coverage": 1.0, "cvss_tp_weight": 113.2, "cvss_fp_weight": 32.5, "cvss_fn_weight": 68.1, "cvss_precision": 0.7797, "cvss_recall": 0.6244, "cvss_f3": 0.6369, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 2, "recall": 0.8 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 8, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6889, "recall": 0.5952, "f1": 0.6354, "f2": 0.61, "f2_score": 61.0, "f3": 0.6024, "f3_score": 60.2, "tpr": 0.5952, "fpr": 0.5892, "youden_j": 0.006, "cvss_coverage": 1.0, "cvss_tp_weight": 115.0, "cvss_fp_weight": 37.8, "cvss_fn_weight": 66.3, "cvss_precision": 0.7593, "cvss_recall": 0.6341, "cvss_f3": 0.6443, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 19, "fp": 3, "fn": 9, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8636, "recall": 0.6786, "f1": 0.76, "f2": 0.709, "f2_score": 70.9, "f3": 0.6934, "f3_score": 69.3, "tpr": 0.6786, "fpr": 0.3333, "youden_j": 0.3452, "cvss_coverage": 1.0, "cvss_tp_weight": 131.2, "cvss_fp_weight": 16.0, "cvss_fn_weight": 50.1, "cvss_precision": 0.8913, "cvss_recall": 0.7237, "cvss_f3": 0.7375, "cvss_f3_score": 73.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 2, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.5357, "f1": 0.6667, "f2": 0.5814, "f2_score": 58.1, "f3": 0.5576, "f3_score": 55.8, "tpr": 0.5357, "fpr": 0.2857, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 107.7, "cvss_fp_weight": 13.5, "cvss_fn_weight": 73.6, "cvss_precision": 0.8886, "cvss_recall": 0.594, "cvss_f3": 0.6144, "cvss_f3_score": 61.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 1, "recall": 0.9 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 23, "fp": 35, "fn": 5, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3966, "recall": 0.8214, "f1": 0.5349, "f2": 0.6765, "f2_score": 67.6, "f3": 0.7419, "f3_score": 74.2, "tpr": 0.8214, "fpr": 0.8537, "youden_j": -0.0322, "cvss_coverage": 1.0, "cvss_tp_weight": 152.4, "cvss_fp_weight": 220.0, "cvss_fn_weight": 28.9, "cvss_precision": 0.4092, "cvss_recall": 0.8406, "cvss_f3": 0.7604, "cvss_f3_score": 76.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-665" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 21, "fp": 15, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.75, "f1": 0.6562, "f2": 0.7095, "f2_score": 70.9, "f3": 0.7292, "f3_score": 72.9, "tpr": 0.75, "fpr": 0.75, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 139.5, "cvss_fp_weight": 88.5, "cvss_fn_weight": 41.8, "cvss_precision": 0.6118, "cvss_recall": 0.7694, "cvss_f3": 0.7501, "cvss_f3_score": 75.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 1, "recall": 0.9 }, "low": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 1, "fn": 27, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0357, "f1": 0.0667, "f2": 0.0439, "f2_score": 4.4, "f3": 0.0394, "f3_score": 3.9, "tpr": 0.0357, "fpr": 0.1429, "youden_j": -0.1071, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 9.5, "cvss_fn_weight": 172.2, "cvss_precision": 0.4892, "cvss_recall": 0.0502, "cvss_f3": 0.0551, "cvss_f3_score": 5.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-016", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 54, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.8571, "f1": 0.4528, "f2": 0.6316, "f2_score": 63.2, "f3": 0.7273, "f3_score": 72.7, "tpr": 0.8571, "fpr": 0.9474, "youden_j": -0.0902, "cvss_coverage": 1.0, "cvss_tp_weight": 156.1, "cvss_fp_weight": 384.5, "cvss_fn_weight": 25.2, "cvss_precision": 0.2888, "cvss_recall": 0.861, "cvss_f3": 0.7186, "cvss_f3_score": 71.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 7, "fp": 1, "fn": 1, "precision": 0.875, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 8, "fp": 1, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-003", "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-002", "file": "python/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/hackable/flag.txt", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "python/hackable/passwords.txt", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssrf.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 8, "fn": 3, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7576, "recall": 0.8929, "f1": 0.8197, "f2": 0.8621, "f2_score": 86.2, "f3": 0.8772, "f3_score": 87.7, "tpr": 0.8929, "fpr": 0.5714, "youden_j": 0.3214, "cvss_coverage": 1.0, "cvss_tp_weight": 163.6, "cvss_fp_weight": 49.0, "cvss_fn_weight": 17.7, "cvss_precision": 0.7695, "cvss_recall": 0.9024, "cvss_f3": 0.8871, "cvss_f3_score": 88.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-018", "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-025", "file": "static/uploads/connect.php", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-029", "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 6, "fn": 11, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.6071, "f1": 0.6667, "f2": 0.6296, "f2_score": 63.0, "f3": 0.6182, "f3_score": 61.8, "tpr": 0.6071, "fpr": 0.5, "youden_j": 0.1071, "cvss_coverage": 1.0, "cvss_tp_weight": 121.6, "cvss_fp_weight": 35.5, "cvss_fn_weight": 59.7, "cvss_precision": 0.774, "cvss_recall": 0.6707, "cvss_f3": 0.6798, "cvss_f3_score": 68.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-028", "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 24, "fp": 72, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.8571, "f1": 0.3871, "f2": 0.5769, "f2_score": 57.7, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.8571, "fpr": 0.96, "youden_j": -0.1029, "cvss_coverage": 1.0, "cvss_tp_weight": 156.1, "cvss_fp_weight": 491.0, "cvss_fn_weight": 25.2, "cvss_precision": 0.2412, "cvss_recall": 0.861, "cvss_f3": 0.685, "cvss_f3_score": 68.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 7, "fp": 1, "fn": 1, "precision": 0.875, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 8, "fp": 1, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-017", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-022", "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-012", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-003", "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-002", "file": "python/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-024", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/database.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-023", "file": "python/hackable/flag.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/hackable/flag.txt", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "python/hackable/passwords.txt", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-015", "file": "python/hackable/passwords.txt", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssrf.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "report.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 12, "fp": 11, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5304, "recall": 0.4286, "f1": 0.4709, "f2": 0.444, "f2_score": 44.4, "f3": 0.4361, "f3_score": 43.6, "tpr": 0.4286, "fpr": 0.6893, "youden_j": -0.2607, "cvss_coverage": 1.0, "cvss_tp_weight": 85.8, "cvss_fp_weight": 58.6, "cvss_fn_weight": 95.5, "cvss_precision": 0.6013, "cvss_recall": 0.4734, "cvss_f3": 0.4828, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 2, "recall": 0.8 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 1, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-003", "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-019", "file": "python/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/comment.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssti.html", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-016", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 5, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5357, "f1": 0.625, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5515, "f3_score": 55.1, "tpr": 0.5357, "fpr": 0.5, "youden_j": 0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 110.2, "cvss_fp_weight": 26.7, "cvss_fn_weight": 71.1, "cvss_precision": 0.8052, "cvss_recall": 0.6078, "cvss_f3": 0.6231, "cvss_f3_score": 62.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-006", "file": "python/templates/dom_xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-009", "file": "python/app.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-014", "file": "python/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-013", "file": "python/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-008", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-027", "file": "python/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-007", "file": "python/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-359" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 34, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1905, "recall": 0.2857, "f1": 0.2286, "f2": 0.2597, "f2_score": 26.0, "f3": 0.2721, "f3_score": 27.2, "tpr": 0.2857, "fpr": 0.8947, "youden_j": -0.609, "cvss_coverage": 1.0, "cvss_tp_weight": 52.9, "cvss_fp_weight": 163.5, "cvss_fn_weight": 128.4, "cvss_precision": 0.2445, "cvss_recall": 0.2918, "cvss_f3": 0.2862, "cvss_f3_score": 28.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 4, "fp": 1, "fn": 6, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 3, "fp": 1, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-001", "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-026", "file": "python/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-020", "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-011", "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-004", "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "owasp-web-playground-fp-003", "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 104, "fn": 22, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0545, "recall": 0.2143, "f1": 0.087, "f2": 0.1351, "f2_score": 13.5, "f3": 0.1657, "f3_score": 16.6, "tpr": 0.2143, "fpr": 0.9455, "youden_j": -0.7312, "cvss_coverage": 1.0, "cvss_tp_weight": 43.8, "cvss_fp_weight": 549.7, "cvss_fn_weight": 137.5, "cvss_precision": 0.0738, "cvss_recall": 0.2416, "cvss_f3": 0.1968, "cvss_f3_score": 19.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-001", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-021", "file": "python/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-002", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-005", "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-003", "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "python/app.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "owasp-web-playground-016", "file": "python/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/bola.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/broken_auth.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/broken_auth.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/broken_auth.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/comment.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/comment.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/comment.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/comment.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/csrf.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/csrf.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/csrf.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/csrf_exploit.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/deserialize.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/deserialize.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/deserialize.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/dom_xss.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/getting_started.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/logout.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/malicious_csrf_exploit.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/reflected_xss.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssrf.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssrf.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssrf.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssti.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/ssti.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/transfer.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/transfer.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/transfer.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/transfer.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/upload.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "python/templates/xxe.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/cache.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/commands/__init__.py", "cwe": "CWE-706" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/commands/configuration.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/commands/search.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/xmlrpc.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/network/xmlrpc.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/self_outdated_check.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_internal/utils/unpacking.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/cachecontrol/_cmd.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/cachecontrol/caches/file_cache.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/distlib/compat.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/distlib/compat.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/distlib/util.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/packaging/licenses/__init__.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pkg_resources/__init__.py", "cwe": "CWE-706" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pygments/formatters/__init__.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pygments/lexers/__init__.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pygments/unistring.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pygments/unistring.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", "cwe": "CWE-706" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/pyproject_hooks/_in_process/_in_process.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/requests/auth.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/requests/auth.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/rich/style.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/rich/style.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/rich/style.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/rich/style.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/truststore/_api.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/contrib/securetransport.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/util/ssl_.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "venv/Lib/site-packages/pip/_vendor/urllib3/util/ssl_.py", "cwe": "CWE-326" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "owasp-web-playground-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-014", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-016", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-019", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-020", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-021", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-022", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-026", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "owasp-web-playground-029", "file": null, "cwe": "CWE-117" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-001", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "owasp-web-playground-fp-006", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-pygoat": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 54, "fp": 70, "fn": 24, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.4355, "recall": 0.6923, "f1": 0.5347, "f2": 0.6193, "f2_score": 61.9, "f3": 0.6538, "f3_score": 65.4, "tpr": 0.6923, "fpr": 0.8861, "youden_j": -0.1938, "cvss_coverage": 1.0, "cvss_tp_weight": 367.9, "cvss_fp_weight": 370.0, "cvss_fn_weight": 136.7, "cvss_precision": 0.4986, "cvss_recall": 0.7291, "cvss_f3": 0.6969, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 1, "fn": 1, "precision": 0.8889, "recall": 0.8889 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.6207 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 19, "fp": 0, "fn": 12, "recall": 0.6129 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 21, "fp": 1, "fn": 8, "recall": 0.7241 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-054", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-615" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "pygoat-066", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-302" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 28, "fp": 13, "fn": 50, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.6829, "recall": 0.359, "f1": 0.4706, "f2": 0.3966, "f2_score": 39.7, "f3": 0.3769, "f3_score": 37.7, "tpr": 0.359, "fpr": 0.5909, "youden_j": -0.2319, "cvss_coverage": 1.0, "cvss_tp_weight": 197.1, "cvss_fp_weight": 69.3, "cvss_fn_weight": 307.5, "cvss_precision": 0.7398, "cvss_recall": 0.3906, "cvss_f3": 0.41, "cvss_f3_score": 41.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 1, "fn": 4, "precision": 0.8333, "recall": 0.5556 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.2069 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 7, "fp": 0, "fn": 24, "recall": 0.2258 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 11, "fp": 1, "fn": 18, "recall": 0.3793 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 33, "fp": 11, "fn": 45, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7746, "recall": 0.4188, "f1": 0.5389, "f2": 0.4592, "f2_score": 45.9, "f3": 0.438, "f3_score": 43.8, "tpr": 0.4188, "fpr": 0.4656, "youden_j": -0.0468, "cvss_coverage": 1.0, "cvss_tp_weight": 233.7, "cvss_fp_weight": 52.4, "cvss_fn_weight": 270.9, "cvss_precision": 0.835, "cvss_recall": 0.4632, "cvss_f3": 0.484, "cvss_f3_score": 48.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.2759 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 21, "recall": 0.2759 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 35, "fp": 12, "fn": 43, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7611, "recall": 0.4487, "f1": 0.5566, "f2": 0.4855, "f2_score": 48.5, "f3": 0.4663, "f3_score": 46.6, "tpr": 0.4487, "fpr": 0.5115, "youden_j": -0.0628, "cvss_coverage": 1.0, "cvss_tp_weight": 250.5, "cvss_fp_weight": 61.2, "cvss_fn_weight": 254.1, "cvss_precision": 0.8301, "cvss_recall": 0.4965, "cvss_f3": 0.5156, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 1, "fn": 2, "precision": 0.875, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.3448 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "high": { "tp": 14, "fp": 0, "fn": 17, "recall": 0.4516 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 14, "fp": 1, "fn": 15, "recall": 0.4828 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 41, "fp": 14, "fn": 37, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7455, "recall": 0.5256, "f1": 0.6165, "f2": 0.5586, "f2_score": 55.9, "f3": 0.5416, "f3_score": 54.2, "tpr": 0.5256, "fpr": 0.5833, "youden_j": -0.0577, "cvss_coverage": 1.0, "cvss_tp_weight": 294.8, "cvss_fp_weight": 54.1, "cvss_fn_weight": 209.8, "cvss_precision": 0.8449, "cvss_recall": 0.5842, "cvss_f3": 0.6028, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.3448 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 14, "fp": 0, "fn": 15, "recall": 0.4828 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 20, "fp": 4, "fn": 58, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.25, "f1": 0.3856, "f2": 0.2908, "f2_score": 29.1, "f3": 0.2689, "f3_score": 26.9, "tpr": 0.25, "fpr": 0.2059, "youden_j": 0.0442, "cvss_coverage": 1.0, "cvss_tp_weight": 147.2, "cvss_fp_weight": 17.4, "cvss_fn_weight": 357.4, "cvss_precision": 0.9101, "cvss_recall": 0.2918, "cvss_f3": 0.3127, "cvss_f3_score": 31.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 26, "precision": 1.0, "recall": 0.1034 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 10, "fp": 0, "fn": 21, "recall": 0.3226 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 28, "recall": 0.0345 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 18, "fp": 6, "fn": 60, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2308, "f1": 0.3529, "f2": 0.2679, "f2_score": 26.8, "f3": 0.2479, "f3_score": 24.8, "tpr": 0.2308, "fpr": 0.4, "youden_j": -0.1692, "cvss_coverage": 1.0, "cvss_tp_weight": 137.0, "cvss_fp_weight": 29.2, "cvss_fn_weight": 367.6, "cvss_precision": 0.8245, "cvss_recall": 0.2715, "cvss_f3": 0.291, "cvss_f3_score": 29.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 1, "fn": 9, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 22, "recall": 0.2903 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 27, "recall": 0.069 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-038", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 33, "fp": 20, "fn": 45, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6288, "recall": 0.4273, "f1": 0.5083, "f2": 0.4563, "f2_score": 45.7, "f3": 0.4414, "f3_score": 44.1, "tpr": 0.4273, "fpr": 0.67, "youden_j": -0.2426, "cvss_coverage": 1.0, "cvss_tp_weight": 233.2, "cvss_fp_weight": 109.3, "cvss_fn_weight": 271.4, "cvss_precision": 0.6808, "cvss_recall": 0.4622, "cvss_f3": 0.4775, "cvss_f3_score": 47.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.2069 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 13, "fp": 0, "fn": 18, "recall": 0.4194 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 23, "recall": 0.2069 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "pygoat-070", "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 42, "fp": 21, "fn": 36, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6688, "recall": 0.5342, "f1": 0.593, "f2": 0.5561, "f2_score": 55.6, "f3": 0.5449, "f3_score": 54.5, "tpr": 0.5342, "fpr": 0.6698, "youden_j": -0.1356, "cvss_coverage": 1.0, "cvss_tp_weight": 294.4, "cvss_fp_weight": 106.4, "cvss_fn_weight": 210.2, "cvss_precision": 0.7371, "cvss_recall": 0.5835, "cvss_f3": 0.5958, "cvss_f3_score": 59.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.4828 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 18, "fp": 0, "fn": 13, "recall": 0.5806 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 11, "fp": 0, "fn": 18, "recall": 0.3793 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 42, "fp": 16, "fn": 36, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7323, "recall": 0.5427, "f1": 0.6221, "f2": 0.5717, "f2_score": 57.1, "f3": 0.5568, "f3_score": 55.7, "tpr": 0.5427, "fpr": 0.6096, "youden_j": -0.0669, "cvss_coverage": 1.0, "cvss_tp_weight": 298.1, "cvss_fp_weight": 81.1, "cvss_fn_weight": 206.5, "cvss_precision": 0.7878, "cvss_recall": 0.5908, "cvss_f3": 0.6056, "cvss_f3_score": 60.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.3793 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 15, "fp": 0, "fn": 14, "recall": 0.5172 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 45, "fp": 27, "fn": 33, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.5769, "f1": 0.6, "f2": 0.5859, "f2_score": 58.6, "f3": 0.5814, "f3_score": 58.1, "tpr": 0.5769, "fpr": 0.75, "youden_j": -0.1731, "cvss_coverage": 1.0, "cvss_tp_weight": 314.1, "cvss_fp_weight": 149.6, "cvss_fn_weight": 190.5, "cvss_precision": 0.6774, "cvss_recall": 0.6225, "cvss_f3": 0.6276, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 1, "fn": 2, "precision": 0.875, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.5172 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 18, "fp": 0, "fn": 13, "recall": 0.5806 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 14, "fp": 1, "fn": 15, "recall": 0.4828 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 40, "fp": 7, "fn": 38, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.8466, "recall": 0.5171, "f1": 0.6418, "f2": 0.5606, "f2_score": 56.1, "f3": 0.538, "f3_score": 53.8, "tpr": 0.5171, "fpr": 0.3997, "youden_j": 0.1174, "cvss_coverage": 1.0, "cvss_tp_weight": 293.7, "cvss_fp_weight": 29.8, "cvss_fn_weight": 210.9, "cvss_precision": 0.9068, "cvss_recall": 0.5821, "cvss_f3": 0.6036, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.3793 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 17, "fp": 0, "fn": 14, "recall": 0.5484 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 20, "recall": 0.3103 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 17, "fp": 5, "fn": 61, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.2179, "f1": 0.34, "f2": 0.2545, "f2_score": 25.4, "f3": 0.2348, "f3_score": 23.5, "tpr": 0.2179, "fpr": 0.3333, "youden_j": -0.1154, "cvss_coverage": 1.0, "cvss_tp_weight": 133.4, "cvss_fp_weight": 28.7, "cvss_fn_weight": 371.2, "cvss_precision": 0.8231, "cvss_recall": 0.2644, "cvss_f3": 0.2836, "cvss_f3_score": 28.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "high": { "tp": 6, "fp": 0, "fn": 25, "recall": 0.1935 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 27, "recall": 0.069 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-053", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 43, "fp": 28, "fn": 35, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6056, "recall": 0.5513, "f1": 0.5772, "f2": 0.5614, "f2_score": 56.1, "f3": 0.5563, "f3_score": 55.6, "tpr": 0.5513, "fpr": 0.7368, "youden_j": -0.1856, "cvss_coverage": 1.0, "cvss_tp_weight": 295.2, "cvss_fp_weight": 97.7, "cvss_fn_weight": 209.4, "cvss_precision": 0.7512, "cvss_recall": 0.585, "cvss_f3": 0.5983, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.4828 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 14, "fp": 0, "fn": 15, "recall": 0.4828 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-257" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 25, "fp": 4, "fn": 53, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.8621, "recall": 0.3205, "f1": 0.4673, "f2": 0.3666, "f2_score": 36.7, "f3": 0.342, "f3_score": 34.2, "tpr": 0.3205, "fpr": 0.2857, "youden_j": 0.0348, "cvss_coverage": 1.0, "cvss_tp_weight": 191.5, "cvss_fp_weight": 22.9, "cvss_fn_weight": 313.1, "cvss_precision": 0.893, "cvss_recall": 0.3795, "cvss_f3": 0.4027, "cvss_f3_score": 40.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 24, "precision": 1.0, "recall": 0.1724 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "high": { "tp": 11, "fp": 0, "fn": 20, "recall": 0.3548 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 26, "recall": 0.1034 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 40, "fp": 33, "fn": 38, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.5479, "recall": 0.5128, "f1": 0.5298, "f2": 0.5195, "f2_score": 51.9, "f3": 0.5161, "f3_score": 51.6, "tpr": 0.5128, "fpr": 0.7674, "youden_j": -0.2546, "cvss_coverage": 1.0, "cvss_tp_weight": 273.6, "cvss_fp_weight": 152.6, "cvss_fn_weight": 231.0, "cvss_precision": 0.642, "cvss_recall": 0.5422, "cvss_f3": 0.5508, "cvss_f3_score": 55.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.4138 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 14, "fp": 0, "fn": 17, "recall": 0.4516 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 13, "fp": 0, "fn": 16, "recall": 0.4483 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/9d73d120683d.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-294" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-645" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/Dockerfile", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-772" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/entrypoint.sh", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 39, "fp": 28, "fn": 39, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.5821, "recall": 0.5, "f1": 0.5379, "f2": 0.5145, "f2_score": 51.5, "f3": 0.5072, "f3_score": 50.7, "tpr": 0.5, "fpr": 0.7368, "youden_j": -0.2368, "cvss_coverage": 1.0, "cvss_tp_weight": 268.8, "cvss_fp_weight": 118.7, "cvss_fn_weight": 235.8, "cvss_precision": 0.6937, "cvss_recall": 0.5327, "cvss_f3": 0.5454, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.4483 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 13, "fp": 0, "fn": 18, "recall": 0.4194 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 14, "fp": 0, "fn": 15, "recall": 0.4828 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 34, "fp": 32, "fn": 44, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.5397, "recall": 0.4402, "f1": 0.4735, "f2": 0.4512, "f2_score": 45.1, "f3": 0.4453, "f3_score": 44.5, "tpr": 0.4402, "fpr": 0.736, "youden_j": -0.2958, "cvss_coverage": 1.0, "cvss_tp_weight": 242.0, "cvss_fp_weight": 173.2, "cvss_fn_weight": 262.6, "cvss_precision": 0.6014, "cvss_recall": 0.4795, "cvss_f3": 0.4871, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 24, "precision": 1.0, "recall": 0.1724 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 10, "fp": 0, "fn": 21, "recall": 0.3226 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 22, "recall": 0.2414 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 35, "fp": 17, "fn": 43, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.6824, "recall": 0.453, "f1": 0.5441, "f2": 0.4855, "f2_score": 48.5, "f3": 0.4686, "f3_score": 46.9, "tpr": 0.453, "fpr": 0.631, "youden_j": -0.1779, "cvss_coverage": 1.0, "cvss_tp_weight": 258.1, "cvss_fp_weight": 83.4, "cvss_fn_weight": 246.5, "cvss_precision": 0.7592, "cvss_recall": 0.5116, "cvss_f3": 0.5286, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 1, "fn": 2, "precision": 0.875, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.2759 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "high": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 10, "fp": 1, "fn": 19, "recall": 0.3448 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-034", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 40, "fp": 24, "fn": 38, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.6306, "recall": 0.5171, "f1": 0.566, "f2": 0.5352, "f2_score": 53.5, "f3": 0.5259, "f3_score": 52.6, "tpr": 0.5171, "fpr": 0.7142, "youden_j": -0.1971, "cvss_coverage": 1.0, "cvss_tp_weight": 288.9, "cvss_fp_weight": 100.8, "cvss_fn_weight": 215.7, "cvss_precision": 0.7462, "cvss_recall": 0.5725, "cvss_f3": 0.5853, "cvss_f3_score": 58.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 1, "fn": 4, "precision": 0.8333, "recall": 0.5556 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.4138 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 17, "fp": 0, "fn": 14, "recall": 0.5484 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 17, "fp": 1, "fn": 12, "recall": 0.5862 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-034", "file": "introduction/views.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 47, "fp": 9, "fn": 31, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.8393, "recall": 0.6026, "f1": 0.7015, "f2": 0.6386, "f2_score": 63.9, "f3": 0.6201, "f3_score": 62.0, "tpr": 0.6026, "fpr": 0.4737, "youden_j": 0.1289, "cvss_coverage": 1.0, "cvss_tp_weight": 328.5, "cvss_fp_weight": 46.4, "cvss_fn_weight": 176.1, "cvss_precision": 0.8763, "cvss_recall": 0.651, "cvss_f3": 0.6682, "cvss_f3_score": 66.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8889 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.4483 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 14, "fp": 0, "fn": 17, "recall": 0.4516 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 19, "fp": 0, "fn": 10, "recall": 0.6552 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 27, "fp": 17, "fn": 51, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6136, "recall": 0.3462, "f1": 0.4426, "f2": 0.3792, "f2_score": 37.9, "f3": 0.3619, "f3_score": 36.2, "tpr": 0.3462, "fpr": 0.6296, "youden_j": -0.2835, "cvss_coverage": 1.0, "cvss_tp_weight": 196.3, "cvss_fp_weight": 112.5, "cvss_fn_weight": 308.3, "cvss_precision": 0.6357, "cvss_recall": 0.389, "cvss_f3": 0.4047, "cvss_f3_score": 40.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 24, "precision": 1.0, "recall": 0.1724 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 10, "fp": 0, "fn": 21, "recall": 0.3226 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 22, "recall": 0.2414 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-010", "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 61, "fp": 114, "fn": 17, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.3486, "recall": 0.7821, "f1": 0.4822, "f2": 0.6263, "f2_score": 62.6, "f3": 0.6956, "f3_score": 69.6, "tpr": 0.7821, "fpr": 0.9194, "youden_j": -0.1373, "cvss_coverage": 1.0, "cvss_tp_weight": 400.7, "cvss_fp_weight": 805.5, "cvss_fn_weight": 103.9, "cvss_precision": 0.3322, "cvss_recall": 0.7941, "cvss_f3": 0.6972, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7778 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7931 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 26, "fp": 0, "fn": 5, "recall": 0.8387 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 21, "fp": 0, "fn": 8, "recall": 0.7241 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-031", "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-759" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-257" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 46, "fp": 41, "fn": 32, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.5287, "recall": 0.5897, "f1": 0.5576, "f2": 0.5764, "f2_score": 57.6, "f3": 0.583, "f3_score": 58.3, "tpr": 0.5897, "fpr": 0.8039, "youden_j": -0.2142, "cvss_coverage": 1.0, "cvss_tp_weight": 291.3, "cvss_fp_weight": 293.5, "cvss_fn_weight": 213.3, "cvss_precision": 0.4981, "cvss_recall": 0.5773, "cvss_f3": 0.5683, "cvss_f3_score": 56.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.4444 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5862 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "high": { "tp": 19, "fp": 0, "fn": 12, "recall": 0.6129 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 17, "fp": 0, "fn": 12, "recall": 0.5862 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 5, "fp": 2, "fn": 73, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.0641, "f1": 0.1176, "f2": 0.0784, "f2_score": 7.8, "f3": 0.0705, "f3_score": 7.1, "tpr": 0.0641, "fpr": 0.1667, "youden_j": -0.1026, "cvss_coverage": 1.0, "cvss_tp_weight": 44.0, "cvss_fp_weight": 16.0, "cvss_fn_weight": 460.6, "cvss_precision": 0.7333, "cvss_recall": 0.0872, "cvss_f3": 0.0956, "cvss_f3_score": 9.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 }, "high": { "tp": 2, "fp": 0, "fn": 29, "recall": 0.0645 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 29, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "pygoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "pygoat-008", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "pygoat-016", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-026", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-027", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 67, "fp": 195, "fn": 11, "tn": 8, "ns": 0, "ns_gt": 0, "precision": 0.2557, "recall": 0.859, "f1": 0.3941, "f2": 0.5836, "f2_score": 58.4, "f3": 0.695, "f3_score": 69.5, "tpr": 0.859, "fpr": 0.9606, "youden_j": -0.1016, "cvss_coverage": 1.0, "cvss_tp_weight": 432.7, "cvss_fp_weight": 1429.5, "cvss_fn_weight": 71.9, "cvss_precision": 0.2324, "cvss_recall": 0.8575, "cvss_f3": 0.6757, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 9, "fp": 1, "fn": 0, "precision": 0.9, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 26, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8966 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 25, "fp": 1, "fn": 6, "recall": 0.8065 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 28, "fp": 1, "fn": 1, "recall": 0.9655 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "challenge/management/commands/populate_challenge.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/Dockerfile", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-066", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/entrypoint.sh", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-054", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-615" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-058", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-053", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-009", "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a7.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a9.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-061", "file": "introduction/static/js/a9.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab2.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A9/a9_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/AUTH/otp.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/bau_lab.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/SQL/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/SQL/sql_lab.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_lab.html", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/secret.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/9d73d120683d.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/9d73d120683d.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/a2538af1b5e4.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/a2538af1b5e4.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-065", "file": "introduction/templates/Lab_2021/A3_Injection/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/ssti_lab.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/ssti_lab.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/desc.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/introduction/base.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/csrf_dashboard.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/csrf_lab_login.html", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-063", "file": "introduction/templates/mitre/mitre_lab_17.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_top14.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_top9.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/playground/A7/index.html", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/playground/A9/index.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/register.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 69, "fp": 46, "fn": 9, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.8846, "f1": 0.715, "f2": 0.808, "f2_score": 80.8, "f3": 0.8446, "f3_score": 84.5, "tpr": 0.8846, "fpr": 0.8214, "youden_j": 0.0632, "cvss_coverage": 1.0, "cvss_tp_weight": 437.0, "cvss_fp_weight": 330.5, "cvss_fn_weight": 67.6, "cvss_precision": 0.5694, "cvss_recall": 0.866, "cvss_f3": 0.8231, "cvss_f3_score": 82.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 9, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 27, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.931 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "high": { "tp": 28, "fp": 0, "fn": 3, "recall": 0.9032 }, "low": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 28, "fp": 0, "fn": 1, "recall": 0.9655 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "challenge/management/commands/populate_challenges.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-066", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-058", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-070", "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-061", "file": "introduction/static/js/a9.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-063", "file": "introduction/templates/mitre/mitre_lab_17.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-034", "file": "introduction/views.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-065", "file": "introduction/templates/Lab_2021/A3_Injection/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-012", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-013", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-037", "file": "introduction/utility.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-008", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-027", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 28, "fp": 63, "fn": 50, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.359, "f1": 0.3314, "f2": 0.3474, "f2_score": 34.7, "f3": 0.3531, "f3_score": 35.3, "tpr": 0.359, "fpr": 0.863, "youden_j": -0.504, "cvss_coverage": 1.0, "cvss_tp_weight": 210.4, "cvss_fp_weight": 492.0, "cvss_fn_weight": 294.2, "cvss_precision": 0.2995, "cvss_recall": 0.417, "cvss_f3": 0.4012, "cvss_f3_score": 40.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.2414 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "high": { "tp": 12, "fp": 0, "fn": 19, "recall": 0.3871 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 24, "recall": 0.1724 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-032", "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 69, "fp": 218, "fn": 9, "tn": 8, "ns": 0, "ns_gt": 0, "precision": 0.2404, "recall": 0.8846, "f1": 0.3781, "f2": 0.576, "f2_score": 57.6, "f3": 0.6977, "f3_score": 69.8, "tpr": 0.8846, "fpr": 0.9646, "youden_j": -0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 442.3, "cvss_fp_weight": 1582.0, "cvss_fn_weight": 62.3, "cvss_precision": 0.2185, "cvss_recall": 0.8765, "cvss_f3": 0.6737, "cvss_f3_score": 67.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 9, "fp": 1, "fn": 0, "precision": 0.9, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "other": { "label": "Other", "tp": 28, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9655 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "high": { "tp": 25, "fp": 1, "fn": 6, "recall": 0.8065 }, "low": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "medium": { "tp": 28, "fp": 1, "fn": 1, "recall": 0.9655 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "challenge/management/commands/populate_challenge.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/management/commands/populate_challenge.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-041", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-042", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-044", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/Dockerfile", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-066", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "pygoat-057", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/entrypoint.sh", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-047", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-054", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-615" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-058", "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-035", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-184" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-036", "file": "introduction/apis.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-053", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-059", "file": "introduction/playground/A9/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-060", "file": "introduction/playground/A9/api.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-070", "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-009", "file": "introduction/playground/ssrf/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a7.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a9.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-061", "file": "introduction/static/js/a9.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A10/a10_lab2.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A9/a9_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/AUTH/otp.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/bau_lab.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/SQL/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/SQL/sql_lab.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-004", "file": "introduction/templates/Lab/XSS/xss_lab_2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-005", "file": "introduction/templates/Lab/XSS/xss_lab_3.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_lab.html", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-062", "file": "introduction/templates/Lab/ssrf/ssrf_lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/secret.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/9d73d120683d.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/9d73d120683d.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/a2538af1b5e4.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/Blogs/a2538af1b5e4.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-065", "file": "introduction/templates/Lab_2021/A3_Injection/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/sql_lab.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/ssti_lab.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A3_Injection/ssti_lab.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A7_auth_failure/lab3.html", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/desc.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-055", "file": "introduction/templates/Lab_2021/A8_software_and_data_integrity_failure/lab2.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/introduction/base.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/csrf_dashboard.html", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/csrf_dashboard.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/csrf_lab_login.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_lab_17.html", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "pygoat-063", "file": "introduction/templates/mitre/mitre_lab_17.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_lab_25.html", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_top14.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/mitre/mitre_top9.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/playground/A7/index.html", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/playground/A9/index.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/register.html", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/utility.py", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "pygoat-064", "file": "introduction/utility.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "pygoat-033", "file": "introduction/views.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-071", "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-022", "file": "pygoat/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 26, "fp": 12, "fn": 52, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.6876, "recall": 0.3376, "f1": 0.4506, "f2": 0.375, "f2_score": 37.5, "f3": 0.3554, "f3_score": 35.5, "tpr": 0.3376, "fpr": 0.5383, "youden_j": -0.2006, "cvss_coverage": 1.0, "cvss_tp_weight": 185.1, "cvss_fp_weight": 65.2, "cvss_fn_weight": 319.5, "cvss_precision": 0.7359, "cvss_recall": 0.3668, "cvss_f3": 0.3859, "cvss_f3_score": 38.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5556 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "high": { "tp": 9, "fp": 0, "fn": 22, "recall": 0.2903 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 26, "recall": 0.1034 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-017", "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "pygoat-014", "file": "introduction/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-11" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-045", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-11" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-038", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 23, "fp": 9, "fn": 55, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.7188, "recall": 0.2949, "f1": 0.4182, "f2": 0.3343, "f2_score": 33.4, "f3": 0.3134, "f3_score": 31.3, "tpr": 0.2949, "fpr": 0.4737, "youden_j": -0.1788, "cvss_coverage": 1.0, "cvss_tp_weight": 166.1, "cvss_fp_weight": 51.6, "cvss_fn_weight": 338.5, "cvss_precision": 0.763, "cvss_recall": 0.3292, "cvss_f3": 0.349, "cvss_f3_score": 34.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.6667 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 27, "precision": 1.0, "recall": 0.069 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "high": { "tp": 9, "fp": 0, "fn": 22, "recall": 0.2903 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 23, "recall": 0.2069 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-019", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-011", "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "pygoat-050", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-051", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-023", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-028", "file": "introduction/mitre.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-046", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "pygoat-052", "file": "dockerized_labs/sensitive_data_exposure/dataexposure/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 0, "fn": 78, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 504.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 31, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 29, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "pygoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "pygoat-008", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "pygoat-016", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-026", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-027", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-038", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "rowan": { "scanner": "rowan", "tp": 30, "fp": 122, "fn": 48, "tn": 10, "ns": 0, "ns_gt": 0, "precision": 0.1974, "recall": 0.3846, "f1": 0.2609, "f2": 0.3233, "f2_score": 32.3, "f3": 0.3513, "f3_score": 35.1, "tpr": 0.3846, "fpr": 0.9242, "youden_j": -0.5396, "cvss_coverage": 1.0, "cvss_tp_weight": 199.8, "cvss_fp_weight": 342.5, "cvss_fn_weight": 304.8, "cvss_precision": 0.3684, "cvss_recall": 0.396, "cvss_f3": 0.393, "cvss_f3_score": 39.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.5517 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "high": { "tp": 13, "fp": 0, "fn": 18, "recall": 0.4194 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 }, "medium": { "tp": 8, "fp": 0, "fn": 21, "recall": 0.2759 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "pygoat-068", "file": "introduction/views.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-056", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "pygoat-048", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "pygoat-049", "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-053", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "pygoat-021", "file": "pygoat/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "pygoat/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "PyGoatBot.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "PyGoatBot.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/sensitive_data_lab/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/lab_code/test.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/Lab/ssrf.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/Lab/ssrf.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a6.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a6.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a7.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a9.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "pygoat-061", "file": "introduction/static/js/a9.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "semgrep": { "scanner": "semgrep", "tp": 25, "fp": 108, "fn": 53, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.188, "recall": 0.3205, "f1": 0.237, "f2": 0.2809, "f2_score": 28.1, "f3": 0.2994, "f3_score": 29.9, "tpr": 0.3205, "fpr": 0.9231, "youden_j": -0.6026, "cvss_coverage": 1.0, "cvss_tp_weight": 166.0, "cvss_fp_weight": 619.3, "cvss_fn_weight": 338.6, "cvss_precision": 0.2114, "cvss_recall": 0.329, "cvss_f3": 0.3116, "cvss_f3_score": 31.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.4138 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "high": { "tp": 13, "fp": 1, "fn": 18, "recall": 0.4194 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 24, "recall": 0.1724 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "challenge/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "pygoat-043", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/templates/lab.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/templates/lab.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/templates/lab.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/broken_auth_lab/templates/reset.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/templates/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/insec_des_lab/templates/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/Dockerfile", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/about.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/about.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/about.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/about.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/lesson.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/lesson.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/lesson.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/lesson.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/lesson.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/login.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/register.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/register.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/register.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/sensitive_data_exposure/templates/register.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/apis.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "pygoat-029", "file": "introduction/mitre.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "pygoat-067", "file": "introduction/mitre.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-024", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-025", "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/mitre.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/api.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/playground/A9/archive.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a7.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/static/js/a9.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "pygoat-061", "file": "introduction/static/js/a9.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A9/a9_lab.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/A9/a9_lab2.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAccess/ba_lab.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/BrokenAuth/otp.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-020", "file": "introduction/templates/Lab/CMD/cmd_lab.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-021", "file": "introduction/templates/Lab/CMD/cmd_lab2.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_discussion.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_discussion.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_discussion.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab/ssrf/ssrf_discussion.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_1.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/templates/Lab_2021/A1_BrokenAccessControl/broken_access_lab_2.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "pygoat-001", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-003", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-006", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-019", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-008", "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-022", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-018", "file": "introduction/views.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-023", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-024", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "pygoat-002", "file": "introduction/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-030", "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "pygoat-fp-025", "file": "introduction/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "pygoat-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-006", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 11, "fp": 11, "fn": 67, "tn": 9, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.141, "f1": 0.22, "f2": 0.1647, "f2_score": 16.5, "f3": 0.1519, "f3_score": 15.2, "tpr": 0.141, "fpr": 0.55, "youden_j": -0.409, "cvss_coverage": 1.0, "cvss_tp_weight": 84.1, "cvss_fp_weight": 103.0, "cvss_fn_weight": 420.5, "cvss_precision": 0.4495, "cvss_recall": 0.1667, "cvss_f3": 0.1779, "cvss_f3_score": 17.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 1, "fn": 6, "precision": 0.75, "recall": 0.3333 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 29, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 }, "high": { "tp": 5, "fp": 0, "fn": 26, "recall": 0.1613 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 27, "recall": 0.069 } }, "details": [ { "classification": "TP", "ground_truth_id": "pygoat-039", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-040", "file": "dockerized_labs/broken_auth_lab/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-038", "file": "dockerized_labs/insec_des_lab/main.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "dockerized_labs/.../sensitive_data_lab/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-026", "file": "introduction/mitre.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "pygoat-027", "file": "introduction/mitre.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "pygoat-003", "file": "introduction/templates/Lab/XSS/xss_lab.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/.../lab2.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "pygoat-007", "file": "introduction/views.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "pygoat-009", "file": "introduction/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-015", "file": "introduction/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "pygoat-016", "file": "introduction/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "pygoat-fp-006", "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "introduction/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "pygoat-020", "file": "pygoat/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "pygoat-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-008", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "pygoat-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-014", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "pygoat-019", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "pygoat-021", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-022", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-028", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-029", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-030", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "pygoat-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-032", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "pygoat-033", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-034", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-035", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-036", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-037", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "pygoat-041", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-042", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "pygoat-043", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-044", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-045", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "pygoat-046", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-047", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-048", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "pygoat-049", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "pygoat-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-051", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-052", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-053", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-003", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-007", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-008", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-009", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "pygoat-fp-010", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "pygoat-054", "file": null, "cwe": "CWE-615" }, { "classification": "FN", "ground_truth_id": "pygoat-055", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-056", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "pygoat-058", "file": null, "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "pygoat-059", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "pygoat-060", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "pygoat-061", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-063", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "pygoat-064", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "pygoat-065", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "pygoat-066", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "pygoat-067", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "pygoat-068", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-069", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "pygoat-070", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-019", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-020", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-021", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-022", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-023", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-fp-025", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "pygoat-071", "file": null, "cwe": "CWE-532" } ] } }, "realvuln-python-app": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 18, "fp": 21, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.8571, "f1": 0.6, "f2": 0.7317, "f2_score": 73.2, "f3": 0.7895, "f3_score": 78.9, "tpr": 0.8571, "fpr": 0.84, "youden_j": 0.0171, "cvss_coverage": 1.0, "cvss_tp_weight": 138.2, "cvss_fp_weight": 122.1, "cvss_fn_weight": 21.1, "cvss_precision": 0.531, "cvss_recall": 0.8675, "cvss_f3": 0.8158, "cvss_f3_score": 81.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-288" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 10, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.5714, "f1": 0.5581, "f2": 0.566, "f2_score": 56.6, "f3": 0.5687, "f3_score": 56.9, "tpr": 0.5714, "fpr": 0.7143, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 99.3, "cvss_fp_weight": 57.8, "cvss_fn_weight": 60.0, "cvss_precision": 0.6319, "cvss_recall": 0.6234, "cvss_f3": 0.6242, "cvss_f3_score": 62.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 5, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7617, "recall": 0.6508, "f1": 0.6883, "f2": 0.6625, "f2_score": 66.2, "f3": 0.6561, "f3_score": 65.6, "tpr": 0.6508, "fpr": 0.4921, "youden_j": 0.1587, "cvss_coverage": 1.0, "cvss_tp_weight": 112.5, "cvss_fp_weight": 27.9, "cvss_fn_weight": 46.8, "cvss_precision": 0.8165, "cvss_recall": 0.706, "cvss_f3": 0.7131, "cvss_f3_score": 71.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/messaging/index.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/sqlite.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 5, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8079, "recall": 0.8095, "f1": 0.8013, "f2": 0.8042, "f2_score": 80.4, "f3": 0.8065, "f3_score": 80.6, "tpr": 0.8095, "fpr": 0.4476, "youden_j": 0.3619, "cvss_coverage": 1.0, "cvss_tp_weight": 130.0, "cvss_fp_weight": 27.8, "cvss_fn_weight": 29.3, "cvss_precision": 0.8462, "cvss_recall": 0.8159, "cvss_f3": 0.8154, "cvss_f3_score": 81.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 2, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.7143, "f1": 0.7895, "f2": 0.7426, "f2_score": 74.3, "f3": 0.7282, "f3_score": 72.8, "tpr": 0.7143, "fpr": 0.3333, "youden_j": 0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 124.3, "cvss_fp_weight": 12.7, "cvss_fn_weight": 35.0, "cvss_precision": 0.907, "cvss_recall": 0.7803, "cvss_f3": 0.7913, "cvss_f3_score": 79.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 3, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7434, "recall": 0.4444, "f1": 0.5503, "f2": 0.4809, "f2_score": 48.1, "f3": 0.4619, "f3_score": 46.2, "tpr": 0.4444, "fpr": 0.4392, "youden_j": 0.0053, "cvss_coverage": 1.0, "cvss_tp_weight": 80.9, "cvss_fp_weight": 19.3, "cvss_fn_weight": 78.4, "cvss_precision": 0.8102, "cvss_recall": 0.5076, "cvss_f3": 0.5262, "cvss_f3_score": 52.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 0, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.381, "f1": 0.5517, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4061, "f3_score": 40.6, "tpr": 0.381, "fpr": 0.0, "youden_j": 0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 70.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 88.5, "cvss_precision": 1.0, "cvss_recall": 0.4444, "cvss_f3": 0.4706, "cvss_f3_score": 47.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8452, "recall": 0.619, "f1": 0.714, "f2": 0.6537, "f2_score": 65.4, "f3": 0.6359, "f3_score": 63.6, "tpr": 0.619, "fpr": 0.3524, "youden_j": 0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 107.3, "cvss_fp_weight": 14.9, "cvss_fn_weight": 52.0, "cvss_precision": 0.8754, "cvss_recall": 0.6736, "cvss_f3": 0.6892, "cvss_f3_score": 68.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 4, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.811, "recall": 0.746, "f1": 0.7756, "f2": 0.7573, "f2_score": 75.7, "f3": 0.7516, "f3_score": 75.2, "tpr": 0.746, "fpr": 0.4762, "youden_j": 0.2698, "cvss_coverage": 1.0, "cvss_tp_weight": 123.4, "cvss_fp_weight": 19.4, "cvss_fn_weight": 35.9, "cvss_precision": 0.8655, "cvss_recall": 0.7747, "cvss_f3": 0.7824, "cvss_f3_score": 78.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 6, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7648, "recall": 0.8095, "f1": 0.7789, "f2": 0.7952, "f2_score": 79.5, "f3": 0.802, "f3_score": 80.2, "tpr": 0.8095, "fpr": 0.5455, "youden_j": 0.2641, "cvss_coverage": 1.0, "cvss_tp_weight": 136.7, "cvss_fp_weight": 26.3, "cvss_fn_weight": 22.6, "cvss_precision": 0.8437, "cvss_recall": 0.8581, "cvss_f3": 0.8555, "cvss_f3_score": 85.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 16, "fp": 7, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.7619, "f1": 0.7273, "f2": 0.7477, "f2_score": 74.8, "f3": 0.7547, "f3_score": 75.5, "tpr": 0.7619, "fpr": 0.6364, "youden_j": 0.1255, "cvss_coverage": 1.0, "cvss_tp_weight": 129.0, "cvss_fp_weight": 32.9, "cvss_fn_weight": 30.3, "cvss_precision": 0.797, "cvss_recall": 0.8098, "cvss_f3": 0.8085, "cvss_f3_score": 80.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 1, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9373, "recall": 0.7143, "f1": 0.8102, "f2": 0.7497, "f2_score": 75.0, "f3": 0.7316, "f3_score": 73.2, "tpr": 0.7143, "fpr": 0.2, "youden_j": 0.5143, "cvss_coverage": 1.0, "cvss_tp_weight": 121.8, "cvss_fp_weight": 6.4, "cvss_fn_weight": 37.5, "cvss_precision": 0.9502, "cvss_recall": 0.7648, "cvss_f3": 0.7799, "cvss_f3_score": 78.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 9, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.4286, "f1": 0.5806, "f2": 0.4787, "f2_score": 47.9, "f3": 0.4523, "f3_score": 45.2, "tpr": 0.4286, "fpr": 0.2, "youden_j": 0.2286, "cvss_coverage": 1.0, "cvss_tp_weight": 75.3, "cvss_fp_weight": 6.4, "cvss_fn_weight": 84.0, "cvss_precision": 0.922, "cvss_recall": 0.4727, "cvss_f3": 0.4969, "cvss_f3_score": 49.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 16, "fp": 6, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.7619, "f1": 0.7442, "f2": 0.7547, "f2_score": 75.5, "f3": 0.7583, "f3_score": 75.8, "tpr": 0.7619, "fpr": 0.6, "youden_j": 0.1619, "cvss_coverage": 1.0, "cvss_tp_weight": 128.4, "cvss_fp_weight": 26.5, "cvss_fn_weight": 30.9, "cvss_precision": 0.829, "cvss_recall": 0.806, "cvss_f3": 0.8083, "cvss_f3_score": 80.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 1, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.6667, "f1": 0.7778, "f2": 0.7071, "f2_score": 70.7, "f3": 0.6863, "f3_score": 68.6, "tpr": 0.6667, "fpr": 0.2, "youden_j": 0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 113.9, "cvss_fp_weight": 6.4, "cvss_fn_weight": 45.4, "cvss_precision": 0.947, "cvss_recall": 0.715, "cvss_f3": 0.733, "cvss_f3_score": 73.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.619, "f1": 0.65, "f2": 0.6311, "f2_score": 63.1, "f3": 0.625, "f3_score": 62.5, "tpr": 0.619, "fpr": 0.6, "youden_j": 0.019, "cvss_coverage": 1.0, "cvss_tp_weight": 107.3, "cvss_fp_weight": 32.4, "cvss_fn_weight": 52.0, "cvss_precision": 0.7683, "cvss_recall": 0.6736, "cvss_f3": 0.682, "cvss_f3_score": 68.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/layout/layout.html", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/models/Messaging.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 14, "fp": 1, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.6667, "f1": 0.7778, "f2": 0.7071, "f2_score": 70.7, "f3": 0.6863, "f3_score": 68.6, "tpr": 0.6667, "fpr": 0.2, "youden_j": 0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 113.4, "cvss_fp_weight": 0.5, "cvss_fn_weight": 45.9, "cvss_precision": 0.9956, "cvss_recall": 0.7119, "cvss_f3": 0.7327, "cvss_f3_score": 73.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.702, "recall": 0.619, "f1": 0.6566, "f2": 0.6333, "f2_score": 63.3, "f3": 0.626, "f3_score": 62.6, "tpr": 0.619, "fpr": 0.5741, "youden_j": 0.045, "cvss_coverage": 1.0, "cvss_tp_weight": 103.6, "cvss_fp_weight": 26.3, "cvss_fn_weight": 55.7, "cvss_precision": 0.8003, "cvss_recall": 0.6503, "cvss_f3": 0.6626, "cvss_f3_score": 66.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-391" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-391" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-391" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 9, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5301, "recall": 0.4286, "f1": 0.4735, "f2": 0.4454, "f2_score": 44.5, "f3": 0.4368, "f3_score": 43.7, "tpr": 0.4286, "fpr": 0.5727, "youden_j": -0.1441, "cvss_coverage": 1.0, "cvss_tp_weight": 74.9, "cvss_fp_weight": 38.9, "cvss_fn_weight": 84.4, "cvss_precision": 0.5567, "cvss_recall": 0.4702, "cvss_f3": 0.4776, "cvss_f3_score": 47.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "project/__init__.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Login.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Confidential.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "project/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 3, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8272, "recall": 0.7619, "f1": 0.7931, "f2": 0.7741, "f2_score": 77.4, "f3": 0.7679, "f3_score": 76.8, "tpr": 0.7619, "fpr": 0.4524, "youden_j": 0.3095, "cvss_coverage": 1.0, "cvss_tp_weight": 127.0, "cvss_fp_weight": 19.3, "cvss_fn_weight": 32.3, "cvss_precision": 0.8678, "cvss_recall": 0.7972, "cvss_f3": 0.8036, "cvss_f3_score": 80.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 2, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.7619, "f1": 0.8205, "f2": 0.7843, "f2_score": 78.4, "f3": 0.7729, "f3_score": 77.3, "tpr": 0.7619, "fpr": 0.3333, "youden_j": 0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 126.3, "cvss_fp_weight": 6.9, "cvss_fn_weight": 33.0, "cvss_precision": 0.9484, "cvss_recall": 0.7928, "cvss_f3": 0.8061, "cvss_f3_score": 80.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 11, "fp": 3, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 0.5238, "f1": 0.6286, "f2": 0.5612, "f2_score": 56.1, "f3": 0.5419, "f3_score": 54.2, "tpr": 0.5238, "fpr": 0.4286, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 95.1, "cvss_fp_weight": 25.5, "cvss_fn_weight": 64.2, "cvss_precision": 0.7886, "cvss_recall": 0.597, "cvss_f3": 0.6119, "cvss_f3_score": 61.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 20, "fp": 45, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.9524, "f1": 0.4651, "f2": 0.6711, "f2_score": 67.1, "f3": 0.7874, "f3_score": 78.7, "tpr": 0.9524, "fpr": 0.9184, "youden_j": 0.034, "cvss_coverage": 1.0, "cvss_tp_weight": 151.8, "cvss_fp_weight": 333.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.3131, "cvss_recall": 0.9529, "cvss_f3": 0.7912, "cvss_f3_score": 79.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/layout/layout.html", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/models/Messaging.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 17, "fp": 40, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2982, "recall": 0.8095, "f1": 0.4359, "f2": 0.6028, "f2_score": 60.3, "f3": 0.6911, "f3_score": 69.1, "tpr": 0.8095, "fpr": 0.9091, "youden_j": -0.0996, "cvss_coverage": 1.0, "cvss_tp_weight": 134.2, "cvss_fp_weight": 292.0, "cvss_fn_weight": 25.1, "cvss_precision": 0.3149, "cvss_recall": 0.8424, "cvss_f3": 0.7215, "cvss_f3_score": 72.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/layout/layout.html", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/login/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/messaging/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "target/requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 6, "fp": 1, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.2857, "f1": 0.4286, "f2": 0.3297, "f2_score": 33.0, "f3": 0.3061, "f3_score": 30.6, "tpr": 0.2857, "fpr": 0.2, "youden_j": 0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 51.9, "cvss_fp_weight": 8.0, "cvss_fn_weight": 107.4, "cvss_precision": 0.8664, "cvss_recall": 0.3258, "cvss_f3": 0.3475, "cvss_f3_score": 34.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 77, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 1.0, "f1": 0.3529, "f2": 0.5769, "f2_score": 57.7, "f3": 0.7317, "f3_score": 73.2, "tpr": 1.0, "fpr": 0.9747, "youden_j": 0.0253, "cvss_coverage": 1.0, "cvss_tp_weight": 159.3, "cvss_fp_weight": 549.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2247, "cvss_recall": 1.0, "cvss_f3": 0.7435, "cvss_f3_score": 74.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": "realvuln-python-app-fp-004", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.tooltip.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/metisMenu.min.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/morris.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/about/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/confidential/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/dashboard/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/login/index.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/login/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "realvuln-python-app-fp-003", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/messaging/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/test.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/requirements.txt", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 12, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6129, "recall": 0.9048, "f1": 0.7308, "f2": 0.8261, "f2_score": 82.6, "f3": 0.8636, "f3_score": 86.4, "tpr": 0.9048, "fpr": 0.75, "youden_j": 0.1548, "cvss_coverage": 1.0, "cvss_tp_weight": 145.7, "cvss_fp_weight": 86.0, "cvss_fn_weight": 13.6, "cvss_precision": 0.6288, "cvss_recall": 0.9146, "cvss_f3": 0.8749, "cvss_f3_score": 87.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/bootstrap.min.js", "cwe": "CWE-1395" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.js", "cwe": "CWE-1395" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/jquery.min.js", "cwe": "CWE-1395" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.4286, "f1": 0.5143, "f2": 0.4592, "f2_score": 45.9, "f3": 0.4433, "f3_score": 44.3, "tpr": 0.4286, "fpr": 0.5556, "youden_j": -0.127, "cvss_coverage": 1.0, "cvss_tp_weight": 82.9, "cvss_fp_weight": 35.5, "cvss_fn_weight": 76.4, "cvss_precision": 0.7002, "cvss_recall": 0.5204, "cvss_f3": 0.5341, "cvss_f3_score": 53.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 88, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.1927, "recall": 1.0, "f1": 0.3231, "f2": 0.544, "f2_score": 54.4, "f3": 0.7047, "f3_score": 70.5, "tpr": 1.0, "fpr": 0.9778, "youden_j": 0.0222, "cvss_coverage": 1.0, "cvss_tp_weight": 159.3, "cvss_fp_weight": 614.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.206, "cvss_recall": 1.0, "cvss_f3": 0.7218, "cvss_f3_score": 72.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 1, "fn": 0, "precision": 0.6667, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-017", "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/config/initializer.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-002", "file": "target/project/controllers/404.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": "realvuln-python-app-fp-004", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-019", "file": "target/project/controllers/Search.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.pie.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/flot/jquery.flot.tooltip.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/metisMenu.min.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/static/js/morris.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/about/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-021", "file": "target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/confidential/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/dashboard/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/layout/layout.html", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/login/index.html", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/login/index.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-015", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "realvuln-python-app-fp-003", "file": "target/project/templates/messaging/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/messaging/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/messaging/index.html", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-018", "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/monitoring/index.html", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/validator/index.html", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-016", "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/webmaster/index.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/test.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "target/requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "target/requirements.txt", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/requirements.txt", "cwe": "CWE-1104" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "target/runserver.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7194, "recall": 0.4286, "f1": 0.5327, "f2": 0.4644, "f2_score": 46.4, "f3": 0.4457, "f3_score": 44.6, "tpr": 0.4286, "fpr": 0.454, "youden_j": -0.0254, "cvss_coverage": 1.0, "cvss_tp_weight": 75.3, "cvss_fp_weight": 23.3, "cvss_fn_weight": 84.0, "cvss_precision": 0.7704, "cvss_recall": 0.4725, "cvss_f3": 0.4904, "cvss_f3_score": 49.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Information.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 11, "fp": 14, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.5238, "f1": 0.4783, "f2": 0.5046, "f2_score": 50.5, "f3": 0.514, "f3_score": 51.4, "tpr": 0.5238, "fpr": 0.7778, "youden_j": -0.254, "cvss_coverage": 1.0, "cvss_tp_weight": 92.8, "cvss_fp_weight": 89.2, "cvss_fn_weight": 66.5, "cvss_precision": 0.5099, "cvss_recall": 0.5825, "cvss_f3": 0.5744, "cvss_f3_score": 57.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-004", "file": "target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/models/Messaging.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-013", "file": "target/project/controllers/Webmaster.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Messaging.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/templates/search/index.html", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/About.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.5238, "f1": 0.5946, "f2": 0.55, "f2_score": 55.0, "f3": 0.5366, "f3_score": 53.7, "tpr": 0.5238, "fpr": 0.5556, "youden_j": -0.0317, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 31.9, "cvss_fn_weight": 70.9, "cvss_precision": 0.7351, "cvss_recall": 0.5549, "cvss_f3": 0.5689, "cvss_f3_score": 56.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-001", "file": "target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-003", "file": "target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-009", "file": "target/project/controllers/Monitoring.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Search.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-006", "file": "target/project/controllers/Validator.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-010", "file": "target/project/controllers/Login.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-012", "file": "target/project/__init__.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-014", "file": "target/runserver.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-020", "file": "target/project/controllers/Confidential.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Confidential.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Login.py", "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 40, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.9091, "youden_j": -0.9091, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 254.9, "cvss_fn_weight": 159.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/Jenkinsfile", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/course-guide/server-side-template-injection/report.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/course-guide/server-side-template-injection/report.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/course-guide/server-side-template-injection/report.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/Dockerfile", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/__init__.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/404.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/404.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/About.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Information.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Validator.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Validator.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/controllers/Webmaster.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/models/Dashboard.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/about/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/about/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/layout/layout.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/layout/layout.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/layout/layout.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/login/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/login/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/login/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/project/templates/validator/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/target/runserver.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/verified_findings.json", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/realvuln-python-app/verified_findings.json", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 3, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.1905, "f1": 0.2857, "f2": 0.2198, "f2_score": 22.0, "f3": 0.2041, "f3_score": 20.4, "tpr": 0.1905, "fpr": 0.4286, "youden_j": -0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 30.9, "cvss_fp_weight": 28.5, "cvss_fn_weight": 128.4, "cvss_precision": 0.5202, "cvss_recall": 0.194, "cvss_f3": 0.207, "cvss_f3_score": 20.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "realvuln-python-app-011", "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/__init__.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/404.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-007", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-008", "file": "target/project/controllers/Validator.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "realvuln-python-app-005", "file": "target/project/templates/search/index.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-002", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-012", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-014", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-015", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-017", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-019", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-020", "file": null, "cwe": "CWE-942" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "realvuln-python-app-fp-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "realvuln-python-app-021", "file": null, "cwe": "CWE-79" } ] } }, "realvuln-python-insecure-app": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 5, "fp": 5, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.625, "f1": 0.5556, "f2": 0.5952, "f2_score": 59.5, "f3": 0.6098, "f3_score": 61.0, "tpr": 0.625, "fpr": 0.7143, "youden_j": -0.0893, "cvss_coverage": 1.0, "cvss_tp_weight": 29.7, "cvss_fp_weight": 15.1, "cvss_fn_weight": 6.8, "cvss_precision": 0.6629, "cvss_recall": 0.8137, "cvss_f3": 0.7956, "cvss_f3_score": 79.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "caddy/Caddyfile", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "caddy/Caddyfile", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 3, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.375, "f1": 0.5, "f2": 0.4167, "f2_score": 41.7, "f3": 0.3947, "f3_score": 39.5, "tpr": 0.375, "fpr": 0.3333, "youden_j": 0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 3.6, "cvss_fn_weight": 15.3, "cvss_precision": 0.8531, "cvss_recall": 0.5808, "cvss_f3": 0.6, "cvss_f3_score": 60.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 5, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8381, "recall": 0.6667, "f1": 0.7385, "f2": 0.693, "f2_score": 69.3, "f3": 0.6795, "f3_score": 67.9, "tpr": 0.6667, "fpr": 0.3333, "youden_j": 0.3334, "cvss_coverage": 1.0, "cvss_tp_weight": 26.1, "cvss_fp_weight": 1.5, "cvss_fn_weight": 10.4, "cvss_precision": 0.9475, "cvss_recall": 0.7151, "cvss_f3": 0.7325, "cvss_f3_score": 73.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8214, "recall": 0.5, "f1": 0.6111, "f2": 0.5378, "f2_score": 53.8, "f3": 0.518, "f3_score": 51.8, "tpr": 0.5, "fpr": 0.2778, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 21.9, "cvss_fp_weight": 1.6, "cvss_fn_weight": 14.6, "cvss_precision": 0.9419, "cvss_recall": 0.6, "cvss_f3": 0.6221, "cvss_f3_score": 62.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".env_temp", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5, "f1": 0.6154, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5195, "f3_score": 51.9, "tpr": 0.5, "fpr": 0.3333, "youden_j": 0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 3.6, "cvss_fn_weight": 15.3, "cvss_precision": 0.8531, "cvss_recall": 0.5808, "cvss_f3": 0.6, "cvss_f3_score": 60.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 2, "fp": 1, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.25, "f1": 0.3636, "f2": 0.2857, "f2_score": 28.6, "f3": 0.2667, "f3_score": 26.7, "tpr": 0.25, "fpr": 0.3333, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 15.1, "cvss_fp_weight": 3.6, "cvss_fn_weight": 21.4, "cvss_precision": 0.8053, "cvss_recall": 0.4137, "cvss_f3": 0.4348, "cvss_f3_score": 43.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 3, "fp": 0, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.375, "f1": 0.5455, "f2": 0.4286, "f2_score": 42.9, "f3": 0.4, "f3_score": 40.0, "tpr": 0.375, "fpr": 0.0, "youden_j": 0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.3, "cvss_precision": 1.0, "cvss_recall": 0.5808, "cvss_f3": 0.6062, "cvss_f3_score": 60.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5, "f1": 0.6287, "f2": 0.5435, "f2_score": 54.4, "f3": 0.5207, "f3_score": 52.1, "tpr": 0.5, "fpr": 0.1667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 21.1, "cvss_fp_weight": 1.4, "cvss_fn_weight": 15.4, "cvss_precision": 0.9317, "cvss_recall": 0.5772, "cvss_f3": 0.5995, "cvss_f3_score": 60.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 7, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.9583, "recall": 0.8333, "f1": 0.8885, "f2": 0.854, "f2_score": 85.4, "f3": 0.8434, "f3_score": 84.3, "tpr": 0.8333, "fpr": 0.1111, "youden_j": 0.7222, "cvss_coverage": 1.0, "cvss_tp_weight": 30.9, "cvss_fp_weight": 0.2, "cvss_fn_weight": 5.6, "cvss_precision": 0.995, "cvss_recall": 0.8456, "cvss_f3": 0.8582, "cvss_f3_score": 85.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 3, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7667, "recall": 0.4167, "f1": 0.5385, "f2": 0.458, "f2_score": 45.8, "f3": 0.4363, "f3_score": 43.6, "tpr": 0.4167, "fpr": 0.3333, "youden_j": 0.0834, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 1.5, "cvss_fn_weight": 15.3, "cvss_precision": 0.9357, "cvss_recall": 0.5808, "cvss_f3": 0.6036, "cvss_f3_score": 60.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 4, "fp": 5, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.5, "f1": 0.4706, "f2": 0.4878, "f2_score": 48.8, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.5, "fpr": 0.7143, "youden_j": -0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 24.9, "cvss_fp_weight": 15.1, "cvss_fn_weight": 11.6, "cvss_precision": 0.6225, "cvss_recall": 0.6822, "cvss_f3": 0.6757, "cvss_f3_score": 67.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1088" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 3, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.4167, "f1": 0.5238, "f2": 0.4532, "f2_score": 45.3, "f3": 0.4341, "f3_score": 43.4, "tpr": 0.4167, "fpr": 0.3889, "youden_j": 0.0278, "cvss_coverage": 1.0, "cvss_tp_weight": 22.8, "cvss_fp_weight": 3.8, "cvss_fn_weight": 13.7, "cvss_precision": 0.8562, "cvss_recall": 0.6246, "cvss_f3": 0.6416, "cvss_f3_score": 64.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 3, "fp": 0, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.375, "f1": 0.5455, "f2": 0.4286, "f2_score": 42.9, "f3": 0.4, "f3_score": 40.0, "tpr": 0.375, "fpr": 0.0, "youden_j": 0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.3, "cvss_precision": 1.0, "cvss_recall": 0.5808, "cvss_f3": 0.6062, "cvss_f3_score": 60.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 7, "fp": 2, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.875, "f1": 0.8235, "f2": 0.8537, "f2_score": 85.4, "f3": 0.8642, "f3_score": 86.4, "tpr": 0.875, "fpr": 0.5, "youden_j": 0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 32.8, "cvss_fp_weight": 4.2, "cvss_fn_weight": 3.7, "cvss_precision": 0.8877, "cvss_recall": 0.8986, "cvss_f3": 0.8975, "cvss_f3_score": 89.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-003", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 4, "fp": 2, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5714, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5128, "f3_score": 51.3, "tpr": 0.5, "fpr": 0.5, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 19.9, "cvss_fp_weight": 4.2, "cvss_fn_weight": 16.6, "cvss_precision": 0.8274, "cvss_recall": 0.5452, "cvss_f3": 0.5645, "cvss_f3_score": 56.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": ".env_temp", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5, "f1": 0.6154, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5195, "f3_score": 51.9, "tpr": 0.5, "fpr": 0.3333, "youden_j": 0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 24.4, "cvss_fp_weight": 3.6, "cvss_fn_weight": 12.1, "cvss_precision": 0.8699, "cvss_recall": 0.6685, "cvss_f3": 0.6843, "cvss_f3_score": 68.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1088" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 5, "fp": 2, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.625, "f1": 0.6667, "f2": 0.641, "f2_score": 64.1, "f3": 0.6329, "f3_score": 63.3, "tpr": 0.625, "fpr": 0.5, "youden_j": 0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 30.7, "cvss_fp_weight": 7.3, "cvss_fn_weight": 5.8, "cvss_precision": 0.8079, "cvss_recall": 0.8411, "cvss_f3": 0.8377, "cvss_f3_score": 83.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-003", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7905, "recall": 0.4583, "f1": 0.5647, "f2": 0.494, "f2_score": 49.4, "f3": 0.4753, "f3_score": 47.5, "tpr": 0.4583, "fpr": 0.3111, "youden_j": 0.1472, "cvss_coverage": 1.0, "cvss_tp_weight": 17.1, "cvss_fp_weight": 2.8, "cvss_fn_weight": 19.4, "cvss_precision": 0.8849, "cvss_recall": 0.4694, "cvss_f3": 0.4899, "cvss_f3_score": 49.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 4, "fp": 1, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.5, "f1": 0.6325, "f2": 0.5455, "f2_score": 54.6, "f3": 0.5218, "f3_score": 52.1, "tpr": 0.5, "fpr": 0.2222, "youden_j": 0.2778, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 1.4, "cvss_fn_weight": 15.3, "cvss_precision": 0.9434, "cvss_recall": 0.5808, "cvss_f3": 0.6039, "cvss_f3_score": 60.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 3, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.4167, "f1": 0.5536, "f2": 0.4619, "f2_score": 46.2, "f3": 0.4381, "f3_score": 43.8, "tpr": 0.4167, "fpr": 0.2222, "youden_j": 0.1945, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 2.4, "cvss_fn_weight": 15.3, "cvss_precision": 0.9021, "cvss_recall": 0.5808, "cvss_f3": 0.6021, "cvss_f3_score": 60.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 4, "fp": 0, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.3, "cvss_precision": 1.0, "cvss_recall": 0.5808, "cvss_f3": 0.6062, "cvss_f3_score": 60.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 4, "fp": 0, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 24.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 11.6, "cvss_precision": 1.0, "cvss_recall": 0.6822, "cvss_f3": 0.7046, "cvss_f3_score": 70.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 5, "fp": 6, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.625, "f1": 0.5263, "f2": 0.5814, "f2_score": 58.1, "f3": 0.6024, "f3_score": 60.2, "tpr": 0.625, "fpr": 0.75, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 29.7, "cvss_fp_weight": 39.5, "cvss_fn_weight": 6.8, "cvss_precision": 0.4292, "cvss_recall": 0.8137, "cvss_f3": 0.7468, "cvss_f3_score": 74.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "caddy/Caddyfile", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "env_temp", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 3, "fp": 7, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3, "recall": 0.375, "f1": 0.3333, "f2": 0.3571, "f2_score": 35.7, "f3": 0.3659, "f3_score": 36.6, "tpr": 0.375, "fpr": 0.7778, "youden_j": -0.4028, "cvss_coverage": 1.0, "cvss_tp_weight": 21.2, "cvss_fp_weight": 42.5, "cvss_fn_weight": 15.3, "cvss_precision": 0.3328, "cvss_recall": 0.5808, "cvss_f3": 0.5405, "cvss_f3_score": 54.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "caddy/Caddyfile", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "caddy/Caddyfile", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "env_temp", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.25, "f1": 0.4, "f2": 0.2941, "f2_score": 29.4, "f3": 0.2703, "f3_score": 27.0, "tpr": 0.25, "fpr": 0.0, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 15.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 21.4, "cvss_precision": 1.0, "cvss_recall": 0.4137, "cvss_f3": 0.4395, "cvss_f3_score": 43.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 6, "fp": 7, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.75, "f1": 0.5714, "f2": 0.6667, "f2_score": 66.7, "f3": 0.7059, "f3_score": 70.6, "tpr": 0.75, "fpr": 0.7778, "youden_j": -0.0278, "cvss_coverage": 1.0, "cvss_tp_weight": 27.0, "cvss_fp_weight": 45.0, "cvss_fn_weight": 9.5, "cvss_precision": 0.375, "cvss_recall": 0.7397, "cvss_f3": 0.6742, "cvss_f3_score": 67.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 7, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.875, "f1": 0.9333, "f2": 0.8974, "f2_score": 89.7, "f3": 0.8861, "f3_score": 88.6, "tpr": 0.875, "fpr": 0.0, "youden_j": 0.875, "cvss_coverage": 1.0, "cvss_tp_weight": 31.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 4.7, "cvss_precision": 1.0, "cvss_recall": 0.8712, "cvss_f3": 0.8826, "cvss_f3_score": 88.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-007", "file": "caddy/Caddyfile", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 2, "fp": 1, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.25, "f1": 0.3636, "f2": 0.2857, "f2_score": 28.6, "f3": 0.2667, "f3_score": 26.7, "tpr": 0.25, "fpr": 0.3333, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 5.5, "cvss_fn_weight": 20.6, "cvss_precision": 0.743, "cvss_recall": 0.4356, "cvss_f3": 0.4544, "cvss_f3_score": 45.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 6, "fp": 7, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.75, "f1": 0.5714, "f2": 0.6667, "f2_score": 66.7, "f3": 0.7059, "f3_score": 70.6, "tpr": 0.75, "fpr": 0.7778, "youden_j": -0.0278, "cvss_coverage": 1.0, "cvss_tp_weight": 27.0, "cvss_fp_weight": 45.0, "cvss_fn_weight": 9.5, "cvss_precision": 0.375, "cvss_recall": 0.7397, "cvss_f3": 0.6742, "cvss_f3_score": 67.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-006", "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yaml", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 3, "fp": 1, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7389, "recall": 0.375, "f1": 0.493, "f2": 0.4143, "f2_score": 41.5, "f3": 0.3936, "f3_score": 39.4, "tpr": 0.375, "fpr": 0.3333, "youden_j": 0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 12.8, "cvss_fp_weight": 3.6, "cvss_fn_weight": 23.7, "cvss_precision": 0.7773, "cvss_recall": 0.3507, "cvss_f3": 0.371, "cvss_f3_score": 37.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 5, "fp": 2, "fn": 3, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.625, "f1": 0.6667, "f2": 0.641, "f2_score": 64.1, "f3": 0.6329, "f3_score": 63.3, "tpr": 0.625, "fpr": 0.6667, "youden_j": -0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 23.3, "cvss_fp_weight": 4.2, "cvss_fn_weight": 13.2, "cvss_precision": 0.8488, "cvss_recall": 0.6384, "cvss_f3": 0.6546, "cvss_f3_score": 65.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 1, "fn": 1, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-002", "file": "app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-004", "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-005", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "python-insecure-app-008", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "python-insecure-app-fp-002", "file": "app/config.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" } ] }, "rowan": { "scanner": "rowan", "tp": 1, "fp": 2, "fn": 7, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.125, "f1": 0.1818, "f2": 0.1429, "f2_score": 14.3, "f3": 0.1333, "f3_score": 13.3, "tpr": 0.125, "fpr": 0.5, "youden_j": -0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 17.5, "cvss_fn_weight": 26.7, "cvss_precision": 0.359, "cvss_recall": 0.2685, "cvss_f3": 0.2754, "cvss_f3_score": 27.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-insecure-app-001", "file": "app/main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 0, "fn": 8, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 36.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "python-insecure-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 8, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 36.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "python-insecure-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-004", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-007", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "python-insecure-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-001", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "python-insecure-app-fp-002", "file": null, "cwe": "CWE-200" } ] } }, "realvuln-pythonssti": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 2, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 5.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.75, "cvss_recall": 1.0, "cvss_f3": 0.9677, "cvss_f3_score": 96.8, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5, "f1": 0.5, "f2": 0.5, "f2_score": 50.0, "f3": 0.5, "f3_score": 50.0, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 5.3, "cvss_fn_weight": 6.1, "cvss_precision": 0.649, "cvss_recall": 0.6164, "cvss_f3": 0.6195, "cvss_f3_score": 61.9, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.6667, "f1": 0.6667, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.6667, "fpr": 0.6667, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 11.8, "cvss_fp_weight": 3.5, "cvss_fn_weight": 4.1, "cvss_precision": 0.766, "cvss_recall": 0.7443, "cvss_f3": 0.7463, "cvss_f3_score": 74.6, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5556, "f2": 0.5185, "f2_score": 51.9, "f3": 0.5088, "f3_score": 50.9, "tpr": 0.5, "fpr": 0.6667, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 3.5, "cvss_fn_weight": 6.1, "cvss_precision": 0.766, "cvss_recall": 0.6164, "cvss_f3": 0.6266, "cvss_f3_score": 62.6, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5, "f1": 0.6111, "f2": 0.5371, "f2_score": 53.7, "f3": 0.5175, "f3_score": 51.7, "tpr": 0.5, "fpr": 0.1667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 1.8, "cvss_fn_weight": 6.1, "cvss_precision": 0.883, "cvss_recall": 0.6164, "cvss_f3": 0.6338, "cvss_f3_score": 63.4, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.6667, "f1": 0.7778, "f2": 0.7037, "f2_score": 70.4, "f3": 0.6842, "f3_score": 68.4, "tpr": 0.6667, "fpr": 0.0, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 11.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 4.1, "cvss_precision": 1.0, "cvss_recall": 0.7443, "cvss_f3": 0.7606, "cvss_f3_score": 76.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5556, "f2": 0.5185, "f2_score": 51.9, "f3": 0.5088, "f3_score": 50.9, "tpr": 0.5, "fpr": 0.6667, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 3.5, "cvss_fn_weight": 6.1, "cvss_precision": 0.766, "cvss_recall": 0.6164, "cvss_f3": 0.6266, "cvss_f3_score": 62.6, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 2, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 5.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.75, "cvss_recall": 1.0, "cvss_f3": 0.9677, "cvss_f3_score": 96.8, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5556, "f2": 0.5185, "f2_score": 51.9, "f3": 0.5088, "f3_score": 50.9, "tpr": 0.5, "fpr": 0.6667, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 3.5, "cvss_fn_weight": 6.1, "cvss_precision": 0.766, "cvss_recall": 0.6164, "cvss_f3": 0.6266, "cvss_f3_score": 62.6, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.8333, "f1": 0.8889, "f2": 0.8519, "f2_score": 85.2, "f3": 0.8421, "f3_score": 84.2, "tpr": 0.8333, "fpr": 0.0, "youden_j": 0.8333, "cvss_coverage": 1.0, "cvss_tp_weight": 13.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 2.0, "cvss_precision": 1.0, "cvss_recall": 0.8721, "cvss_f3": 0.8803, "cvss_f3_score": 88.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 2, "fp": 4, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 1.0, "f1": 0.5, "f2": 0.7143, "f2_score": 71.4, "f3": 0.8333, "f3_score": 83.3, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 19.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.4556, "cvss_recall": 1.0, "cvss_f3": 0.8933, "cvss_f3_score": 89.3, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-116" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 2, "fp": 3, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 1.0, "f1": 0.5714, "f2": 0.7692, "f2_score": 76.9, "f3": 0.8696, "f3_score": 87.0, "tpr": 1.0, "fpr": 0.75, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 19.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.4556, "cvss_recall": 1.0, "cvss_f3": 0.8933, "cvss_f3_score": 89.3, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-116" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 2, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 9.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.626, "cvss_recall": 1.0, "cvss_f3": 0.9436, "cvss_f3_score": 94.4, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-94" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 2, "fp": 1, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 5.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.743, "cvss_recall": 1.0, "cvss_f3": 0.9666, "cvss_f3_score": 96.7, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 2, "fp": 2, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 15.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.5146, "cvss_recall": 1.0, "cvss_f3": 0.9138, "cvss_f3_score": 91.4, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-94" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 6.1, "cvss_precision": 1.0, "cvss_recall": 0.6164, "cvss_f3": 0.6409, "cvss_f3_score": 64.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 2, "fp": 0, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 2, "fp": 1, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 15.9, "cvss_fp_weight": 5.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.75, "cvss_recall": 1.0, "cvss_f3": 0.9677, "cvss_f3_score": 96.8, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-614" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "rowan": { "scanner": "rowan", "tp": 1, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5, "f1": 0.5, "f2": 0.5, "f2_score": 50.0, "f3": 0.5, "f3_score": 50.0, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 9.5, "cvss_fn_weight": 6.1, "cvss_precision": 0.5078, "cvss_recall": 0.6164, "cvss_f3": 0.6034, "cvss_f3_score": 60.3, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-001", "file": "main.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "python-ssti-fp-001", "file": "main.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" } ] }, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 0, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 9.8, "cvss_precision": 1.0, "cvss_recall": 0.3836, "cvss_f3": 0.4088, "cvss_f3_score": 40.9, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "python-ssti-002", "file": "main.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "python-ssti-001", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 2, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "python-ssti-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "python-ssti-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "python-ssti-fp-001", "file": null, "cwe": "CWE-1336" } ] } }, "realvuln-react-security": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 4, "fp": 11, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.5714, "f1": 0.3636, "f2": 0.4651, "f2_score": 46.5, "f3": 0.5128, "f3_score": 51.3, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 27.5, "cvss_fp_weight": 58.9, "cvss_fn_weight": 17.5, "cvss_precision": 0.3184, "cvss_recall": 0.6111, "cvss_f3": 0.5597, "cvss_f3_score": 56.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/DangerousHTML.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 0, "fp": 0, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 45.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "react-security-001", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "react-security-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-004", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 2, "fp": 9, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1818, "recall": 0.2857, "f1": 0.2222, "f2": 0.2564, "f2_score": 25.6, "f3": 0.2703, "f3_score": 27.0, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 17.3, "cvss_fp_weight": 46.0, "cvss_fn_weight": 27.7, "cvss_precision": 0.2733, "cvss_recall": 0.3844, "cvss_f3": 0.3694, "cvss_f3_score": 36.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/DangerousHTML.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "react-security-001", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 3, "fp": 11, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.4286, "f1": 0.2857, "f2": 0.3571, "f2_score": 35.7, "f3": 0.3896, "f3_score": 39.0, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 23.2, "cvss_fp_weight": 64.8, "cvss_fn_weight": 21.8, "cvss_precision": 0.2637, "cvss_recall": 0.5156, "cvss_f3": 0.4706, "cvss_f3_score": 47.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/DangerousHTML.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/configuration", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "authentication/src/Auth.js", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/bin/configuredb.sh", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 4, "fp": 18, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1818, "recall": 0.5714, "f1": 0.2759, "f2": 0.4, "f2_score": 40.0, "f3": 0.4706, "f3_score": 47.1, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 27.5, "cvss_fp_weight": 92.0, "cvss_fn_weight": 17.5, "cvss_precision": 0.2301, "cvss_recall": 0.6111, "cvss_f3": 0.5243, "cvss_f3_score": 52.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/configuration", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "authentication/src/Auth.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/DangerousHTML.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/DangerousHTML.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 7, "fp": 11, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 1.0, "f1": 0.56, "f2": 0.7609, "f2_score": 76.1, "f3": 0.8642, "f3_score": 86.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 45.0, "cvss_fp_weight": 64.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.4099, "cvss_recall": 1.0, "cvss_f3": 0.8742, "cvss_f3_score": 87.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "authentication/src/Auth.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-003", "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/configuration", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "react-security-005", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "react-security-007", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 6, "fp": 8, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.8571, "f1": 0.5714, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7792, "f3_score": 77.9, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 40.8, "cvss_fp_weight": 51.4, "cvss_fn_weight": 4.2, "cvss_precision": 0.4424, "cvss_recall": 0.9067, "cvss_f3": 0.8205, "cvss_f3_score": 82.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "react-security-003", "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/configuration", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "react-security-002", "file": "fullstack_auth/backend/secrets/db_configuration.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "react-security-007", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 4, "fp": 11, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.5714, "f1": 0.3636, "f2": 0.4651, "f2_score": 46.5, "f3": 0.5128, "f3_score": 51.3, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 26.8, "cvss_fp_weight": 70.7, "cvss_fn_weight": 18.2, "cvss_precision": 0.2748, "cvss_recall": 0.5956, "cvss_f3": 0.5333, "cvss_f3_score": 53.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "react-security-003", "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/configuration", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "authentication/src/Auth.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/UserHref.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-security-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 5, "fp": 10, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.7143, "f1": 0.4545, "f2": 0.5814, "f2_score": 58.1, "f3": 0.641, "f3_score": 64.1, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 31.0, "cvss_fp_weight": 75.0, "cvss_fn_weight": 14.0, "cvss_precision": 0.2925, "cvss_recall": 0.6889, "cvss_f3": 0.6067, "cvss_f3_score": 60.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "react-security-001", "file": "fullstack_auth/backend/helper.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "react-security-006", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "react-security-007", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/user.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "react-security-003", "file": "fullstack_auth/backend/secrets/index.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "react-security-004", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "react-security-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "react-security-005", "file": null, "cwe": "CWE-1275" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 4, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.1429, "f1": 0.1667, "f2": 0.1515, "f2_score": 15.2, "f3": 0.1471, "f3_score": 14.7, "tpr": 0.1429, "fpr": 1.0, "youden_j": -0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 4.2, "cvss_fp_weight": 13.9, "cvss_fn_weight": 40.8, "cvss_precision": 0.2326, "cvss_recall": 0.0933, "cvss_f3": 0.0993, "cvss_f3_score": 9.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/backend/app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "react-security-005", "file": "fullstack_auth/backend/user.js", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "fullstack_auth/frontend/server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/components/Eval.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "security_examples/php/index.php", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-security-001", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "react-security-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "react-security-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "react-security-004", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "react-security-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "react-security-007", "file": null, "cwe": "CWE-613" } ] }, "sonarqube": null }, "realvuln-react-test-bench": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 1, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 5.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.5, "cvss_recall": 1.0, "cvss_f3": 0.9091, "cvss_f3_score": 90.9, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 5.4, "cvss_fn_weight": 5.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "react-test-bench-001", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 1, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 5.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.5, "cvss_recall": 1.0, "cvss_f3": 0.9091, "cvss_f3_score": 90.9, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "react-test-bench-001", "file": "src/pages/Vulnerabilities/DomXSS/index.jsx", "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 6, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 32.4, "cvss_fn_weight": 5.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/ci.yml", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "react-test-bench-001", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": null }, "realvuln-reactvulna": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 0, "fp": 8, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 31.0, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Login.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/index.js", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 0, "fp": 10, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 53.6, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/App.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-88" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 7, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 35.9, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Register.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Login.js", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 0, "fp": 9, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 53.1, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Register.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/App.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 0, "fp": 11, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 48.7, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Login.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/App.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Login.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 1, "fp": 6, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 1.0, "f1": 0.25, "f2": 0.4545, "f2_score": 45.5, "f3": 0.625, "f3_score": 62.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 35.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.1429, "cvss_recall": 1.0, "cvss_f3": 0.625, "cvss_f3_score": 62.5, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "reactvulna-001", "file": "src/Constants.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/App.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 0, "fp": 5, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 24.1, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 1, "fp": 8, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1111, "recall": 1.0, "f1": 0.2, "f2": 0.3846, "f2_score": 38.5, "f3": 0.5556, "f3_score": 55.6, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 31.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.1599, "cvss_recall": 1.0, "cvss_f3": 0.6556, "cvss_f3_score": 65.6, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-1022" }, { "classification": "TP", "ground_truth_id": "reactvulna-001", "file": "src/Constants.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Login.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-532" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 1, "fp": 3, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 1.0, "f1": 0.4, "f2": 0.625, "f2_score": 62.5, "f3": 0.7692, "f3_score": 76.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 24.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.1973, "cvss_recall": 1.0, "cvss_f3": 0.7108, "cvss_f3_score": 71.1, "per_family": { "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "reactvulna-001", "file": "src/Constants.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Constants.js", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/Users.js", "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 0, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 5.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "reactvulna-001", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null }, "realvuln-simply-vulnerable-react": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 1, "fp": 12, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0769, "recall": 1.0, "f1": 0.1429, "f2": 0.2941, "f2_score": 29.4, "f3": 0.4545, "f3_score": 45.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 73.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.0769, "cvss_recall": 1.0, "cvss_f3": 0.4545, "cvss_f3_score": 45.5, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-942" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 1, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0588, "recall": 1.0, "f1": 0.1111, "f2": 0.2381, "f2_score": 23.8, "f3": 0.3846, "f3_score": 38.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 97.6, "cvss_fn_weight": 0.0, "cvss_precision": 0.0588, "cvss_recall": 1.0, "cvss_f3": 0.3846, "cvss_f3_score": 38.5, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 1, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0588, "recall": 1.0, "f1": 0.1111, "f2": 0.2381, "f2_score": 23.8, "f3": 0.3846, "f3_score": 38.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 92.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.0622, "cvss_recall": 1.0, "cvss_f3": 0.3987, "cvss_f3_score": 39.9, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-942" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 1, "fp": 19, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.05, "recall": 1.0, "f1": 0.0952, "f2": 0.2083, "f2_score": 20.8, "f3": 0.3448, "f3_score": 34.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 115.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.05, "cvss_recall": 1.0, "cvss_f3": 0.3448, "cvss_f3_score": 34.5, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/routes/inject.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/routes/inject.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-942" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 1, "fp": 17, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0556, "recall": 1.0, "f1": 0.1053, "f2": 0.2273, "f2_score": 22.7, "f3": 0.3704, "f3_score": 37.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 98.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.0585, "cvss_recall": 1.0, "cvss_f3": 0.3834, "cvss_f3_score": 38.3, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-942" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 1, "fp": 15, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0625, "recall": 1.0, "f1": 0.1176, "f2": 0.25, "f2_score": 25.0, "f3": 0.4, "f3_score": 40.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 91.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.0625, "cvss_recall": 1.0, "cvss_f3": 0.4, "cvss_f3_score": 40.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 1, "fp": 14, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0667, "recall": 1.0, "f1": 0.125, "f2": 0.2632, "f2_score": 26.3, "f3": 0.4167, "f3_score": 41.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 85.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.0667, "cvss_recall": 1.0, "cvss_f3": 0.4167, "cvss_f3_score": 41.7, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/logical.jsx", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 1, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 1, "fp": 14, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0667, "recall": 1.0, "f1": 0.125, "f2": 0.2632, "f2_score": 26.3, "f3": 0.4167, "f3_score": 41.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 6.1, "cvss_fp_weight": 107.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.0539, "cvss_recall": 1.0, "cvss_f3": 0.3631, "cvss_f3_score": 36.3, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views/error.jade", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/client-side-xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/href.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "simply-vulnerable-react-001", "file": "client/src/client-side-xss/queryparams.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_escaped.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/reactdom_vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_unsafe.jsx", "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 19, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 110.3, "cvss_fn_weight": 6.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-pr-workflow.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-pr-workflow.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-pr-workflow.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-pr-workflow.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-1357" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/checkmarx-push-workflow.yml", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "api/app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/bin/www", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/embedded.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_func.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/client-side-xss/vulnerable_render_lambda.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/server-side-xss/remote_render_funcs.jsx", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "simply-vulnerable-react-001", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": null }, "realvuln-threatbyte": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 11, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.7308, "f1": 0.6786, "f2": 0.709, "f2_score": 70.9, "f3": 0.7197, "f3_score": 72.0, "tpr": 0.7308, "fpr": 0.6875, "youden_j": 0.0433, "cvss_coverage": 1.0, "cvss_tp_weight": 126.3, "cvss_fp_weight": 51.4, "cvss_fn_weight": 47.4, "cvss_precision": 0.7106, "cvss_recall": 0.7271, "cvss_f3": 0.7254, "cvss_f3_score": 72.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 6, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4615, "f1": 0.5455, "f2": 0.4918, "f2_score": 49.2, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4615, "fpr": 0.5455, "youden_j": -0.0839, "cvss_coverage": 1.0, "cvss_tp_weight": 88.5, "cvss_fp_weight": 28.5, "cvss_fn_weight": 85.2, "cvss_precision": 0.7563, "cvss_recall": 0.5095, "cvss_f3": 0.5267, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 2, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8917, "recall": 0.5, "f1": 0.6389, "f2": 0.5474, "f2_score": 54.8, "f3": 0.5226, "f3_score": 52.3, "tpr": 0.5, "fpr": 0.2361, "youden_j": 0.2639, "cvss_coverage": 1.0, "cvss_tp_weight": 84.5, "cvss_fp_weight": 9.3, "cvss_fn_weight": 89.2, "cvss_precision": 0.9048, "cvss_recall": 0.4865, "cvss_f3": 0.5098, "cvss_f3_score": 51.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 1, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9188, "recall": 0.4423, "f1": 0.5953, "f2": 0.4928, "f2_score": 49.3, "f3": 0.4662, "f3_score": 46.6, "tpr": 0.4423, "fpr": 0.1667, "youden_j": 0.2756, "cvss_coverage": 1.0, "cvss_tp_weight": 80.3, "cvss_fp_weight": 5.6, "cvss_fn_weight": 93.4, "cvss_precision": 0.9342, "cvss_recall": 0.4622, "cvss_f3": 0.4867, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 1, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 0.6538, "f1": 0.7727, "f2": 0.6967, "f2_score": 69.7, "f3": 0.6746, "f3_score": 67.5, "tpr": 0.6538, "fpr": 0.1667, "youden_j": 0.4872, "cvss_coverage": 1.0, "cvss_tp_weight": 115.7, "cvss_fp_weight": 5.6, "cvss_fn_weight": 58.0, "cvss_precision": 0.9538, "cvss_recall": 0.6661, "cvss_f3": 0.6868, "cvss_f3_score": 68.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 4, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7879, "recall": 0.4231, "f1": 0.543, "f2": 0.4633, "f2_score": 46.4, "f3": 0.4422, "f3_score": 44.2, "tpr": 0.4231, "fpr": 0.3561, "youden_j": 0.067, "cvss_coverage": 1.0, "cvss_tp_weight": 76.7, "cvss_fp_weight": 17.1, "cvss_fn_weight": 97.0, "cvss_precision": 0.8374, "cvss_recall": 0.4415, "cvss_f3": 0.4622, "cvss_f3_score": 46.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 2, "fn": 19, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.2692, "f1": 0.4, "f2": 0.3097, "f2_score": 31.0, "f3": 0.2881, "f3_score": 28.8, "tpr": 0.2692, "fpr": 0.2857, "youden_j": -0.0165, "cvss_coverage": 1.0, "cvss_tp_weight": 47.6, "cvss_fp_weight": 11.2, "cvss_fn_weight": 126.1, "cvss_precision": 0.8094, "cvss_recall": 0.274, "cvss_f3": 0.2934, "cvss_f3_score": 29.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 6, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6568, "recall": 0.4487, "f1": 0.5322, "f2": 0.4787, "f2_score": 47.9, "f3": 0.4632, "f3_score": 46.3, "tpr": 0.4487, "fpr": 0.5337, "youden_j": -0.085, "cvss_coverage": 1.0, "cvss_tp_weight": 80.6, "cvss_fp_weight": 35.5, "cvss_fn_weight": 93.1, "cvss_precision": 0.7001, "cvss_recall": 0.464, "cvss_f3": 0.4801, "cvss_f3_score": 48.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-539" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7605, "recall": 0.6154, "f1": 0.6788, "f2": 0.639, "f2_score": 63.9, "f3": 0.6269, "f3_score": 62.7, "tpr": 0.6154, "fpr": 0.5112, "youden_j": 0.1042, "cvss_coverage": 1.0, "cvss_tp_weight": 104.3, "cvss_fp_weight": 29.9, "cvss_fn_weight": 69.4, "cvss_precision": 0.785, "cvss_recall": 0.6003, "cvss_f3": 0.6145, "cvss_f3_score": 61.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 11, "fp": 2, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5669, "recall": 0.4231, "f1": 0.4826, "f2": 0.4447, "f2_score": 44.5, "f3": 0.4336, "f3_score": 43.4, "tpr": 0.4231, "fpr": 0.2434, "youden_j": 0.1797, "cvss_coverage": 1.0, "cvss_tp_weight": 73.9, "cvss_fp_weight": 9.5, "cvss_fn_weight": 99.8, "cvss_precision": 0.5955, "cvss_recall": 0.4253, "cvss_f3": 0.4371, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 8, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.68, "recall": 0.6538, "f1": 0.6667, "f2": 0.6589, "f2_score": 65.9, "f3": 0.6564, "f3_score": 65.6, "tpr": 0.6538, "fpr": 0.6154, "youden_j": 0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 118.5, "cvss_fp_weight": 29.5, "cvss_fn_weight": 55.2, "cvss_precision": 0.8006, "cvss_recall": 0.6822, "cvss_f3": 0.6924, "cvss_f3_score": 69.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 4, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7926, "recall": 0.5385, "f1": 0.6409, "f2": 0.5752, "f2_score": 57.5, "f3": 0.5562, "f3_score": 55.6, "tpr": 0.5385, "fpr": 0.4213, "youden_j": 0.1172, "cvss_coverage": 1.0, "cvss_tp_weight": 96.3, "cvss_fp_weight": 18.8, "cvss_fn_weight": 77.4, "cvss_precision": 0.8357, "cvss_recall": 0.5544, "cvss_f3": 0.5737, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 1, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.5, "f1": 0.65, "f2": 0.5508, "f2_score": 55.1, "f3": 0.5242, "f3_score": 52.4, "tpr": 0.5, "fpr": 0.1667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 87.3, "cvss_fp_weight": 5.6, "cvss_fn_weight": 86.4, "cvss_precision": 0.9397, "cvss_recall": 0.5026, "cvss_f3": 0.5271, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 21, "fp": 8, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7241, "recall": 0.8077, "f1": 0.7636, "f2": 0.7895, "f2_score": 78.9, "f3": 0.7985, "f3_score": 79.8, "tpr": 0.8077, "fpr": 0.6154, "youden_j": 0.1923, "cvss_coverage": 1.0, "cvss_tp_weight": 139.1, "cvss_fp_weight": 29.5, "cvss_fn_weight": 34.6, "cvss_precision": 0.825, "cvss_recall": 0.8008, "cvss_f3": 0.8032, "cvss_f3_score": 80.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 16, "fp": 1, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9412, "recall": 0.6154, "f1": 0.7442, "f2": 0.6612, "f2_score": 66.1, "f3": 0.6375, "f3_score": 63.7, "tpr": 0.6154, "fpr": 0.1667, "youden_j": 0.4487, "cvss_coverage": 1.0, "cvss_tp_weight": 105.9, "cvss_fp_weight": 5.6, "cvss_fn_weight": 67.8, "cvss_precision": 0.9497, "cvss_recall": 0.6097, "cvss_f3": 0.6323, "cvss_f3_score": 63.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 7, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5385, "f1": 0.5957, "f2": 0.56, "f2_score": 56.0, "f3": 0.549, "f3_score": 54.9, "tpr": 0.5385, "fpr": 0.5833, "youden_j": -0.0449, "cvss_coverage": 1.0, "cvss_tp_weight": 95.0, "cvss_fp_weight": 34.1, "cvss_fn_weight": 78.7, "cvss_precision": 0.7358, "cvss_recall": 0.5469, "cvss_f3": 0.5613, "cvss_f3_score": 56.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/__init__.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 11, "fn": 6, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6452, "recall": 0.7692, "f1": 0.7018, "f2": 0.7407, "f2_score": 74.1, "f3": 0.7547, "f3_score": 75.5, "tpr": 0.7692, "fpr": 0.6875, "youden_j": 0.0817, "cvss_coverage": 1.0, "cvss_tp_weight": 131.1, "cvss_fp_weight": 46.3, "cvss_fn_weight": 42.6, "cvss_precision": 0.7389, "cvss_recall": 0.7547, "cvss_f3": 0.7531, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 13, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.526, "recall": 0.4872, "f1": 0.4995, "f2": 0.4906, "f2_score": 49.0, "f3": 0.4886, "f3_score": 48.9, "tpr": 0.4872, "fpr": 0.7384, "youden_j": -0.2512, "cvss_coverage": 1.0, "cvss_tp_weight": 86.2, "cvss_fp_weight": 64.2, "cvss_fn_weight": 87.5, "cvss_precision": 0.5903, "cvss_recall": 0.4962, "cvss_f3": 0.5031, "cvss_f3_score": 50.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 2, "fn": 4, "recall": 0.6 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "threatbyte-fp-003", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "threatbyte-fp-005", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "threatbyte-019", "file": "server/routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 2, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9003, "recall": 0.5641, "f1": 0.69, "f2": 0.6081, "f2_score": 60.8, "f3": 0.5852, "f3_score": 58.5, "tpr": 0.5641, "fpr": 0.246, "youden_j": 0.3181, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 9.3, "cvss_fn_weight": 74.3, "cvss_precision": 0.916, "cvss_recall": 0.5723, "cvss_f3": 0.5937, "cvss_f3_score": 59.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 7, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6945, "recall": 0.5641, "f1": 0.619, "f2": 0.5843, "f2_score": 58.4, "f3": 0.5739, "f3_score": 57.4, "tpr": 0.5641, "fpr": 0.5584, "youden_j": 0.0057, "cvss_coverage": 1.0, "cvss_tp_weight": 102.2, "cvss_fp_weight": 30.5, "cvss_fn_weight": 71.5, "cvss_precision": 0.7738, "cvss_recall": 0.5884, "cvss_f3": 0.6022, "cvss_f3_score": 60.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 5, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.6154, "f1": 0.6809, "f2": 0.64, "f2_score": 64.0, "f3": 0.6275, "f3_score": 62.7, "tpr": 0.6154, "fpr": 0.5, "youden_j": 0.1154, "cvss_coverage": 1.0, "cvss_tp_weight": 107.1, "cvss_fp_weight": 17.8, "cvss_fn_weight": 66.6, "cvss_precision": 0.8574, "cvss_recall": 0.6166, "cvss_f3": 0.6344, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 4, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4615, "f1": 0.5714, "f2": 0.5, "f2_score": 50.0, "f3": 0.48, "f3_score": 48.0, "tpr": 0.4615, "fpr": 0.4444, "youden_j": 0.0171, "cvss_coverage": 1.0, "cvss_tp_weight": 85.1, "cvss_fp_weight": 35.0, "cvss_fn_weight": 88.6, "cvss_precision": 0.7086, "cvss_recall": 0.4899, "cvss_f3": 0.5055, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 50, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2958, "recall": 0.8077, "f1": 0.433, "f2": 0.6, "f2_score": 60.0, "f3": 0.6885, "f3_score": 68.9, "tpr": 0.8077, "fpr": 0.9091, "youden_j": -0.1014, "cvss_coverage": 1.0, "cvss_tp_weight": 139.1, "cvss_fp_weight": 320.0, "cvss_fn_weight": 34.6, "cvss_precision": 0.303, "cvss_recall": 0.8008, "cvss_f3": 0.6878, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "server/__init__.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/__init__.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 19, "fp": 18, "fn": 7, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5135, "recall": 0.7308, "f1": 0.6032, "f2": 0.6738, "f2_score": 67.4, "f3": 0.7011, "f3_score": 70.1, "tpr": 0.7308, "fpr": 0.7826, "youden_j": -0.0518, "cvss_coverage": 1.0, "cvss_tp_weight": 126.8, "cvss_fp_weight": 110.5, "cvss_fn_weight": 46.9, "cvss_precision": 0.5343, "cvss_recall": 0.73, "cvss_f3": 0.7042, "cvss_f3_score": 70.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 2, "fn": 25, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.0385, "f1": 0.069, "f2": 0.0467, "f2_score": 4.7, "f3": 0.0422, "f3_score": 4.2, "tpr": 0.0385, "fpr": 0.2857, "youden_j": -0.2473, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 16.0, "cvss_fn_weight": 163.9, "cvss_precision": 0.3798, "cvss_recall": 0.0564, "cvss_f3": 0.0617, "cvss_f3_score": 6.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "threatbyte-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-006", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "threatbyte-008", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 38, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3559, "recall": 0.8077, "f1": 0.4941, "f2": 0.6442, "f2_score": 64.4, "f3": 0.7167, "f3_score": 71.7, "tpr": 0.8077, "fpr": 0.8837, "youden_j": -0.076, "cvss_coverage": 1.0, "cvss_tp_weight": 144.8, "cvss_fp_weight": 279.5, "cvss_fn_weight": 28.9, "cvss_precision": 0.3413, "cvss_recall": 0.8336, "cvss_f3": 0.7285, "cvss_f3_score": 72.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/dashboard.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/__init__.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-017", "file": "server/api/v1/api_v1.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-019", "file": "server/routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/run.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 12, "fn": 2, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.9231, "f1": 0.7742, "f2": 0.8571, "f2_score": 85.7, "f3": 0.8889, "f3_score": 88.9, "tpr": 0.9231, "fpr": 0.7059, "youden_j": 0.2172, "cvss_coverage": 1.0, "cvss_tp_weight": 162.4, "cvss_fp_weight": 91.0, "cvss_fn_weight": 11.3, "cvss_precision": 0.6409, "cvss_recall": 0.9349, "cvss_f3": 0.8939, "cvss_f3_score": 89.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-017", "file": "server/api/v1/api_v1.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-020", "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-019", "file": "server/routes.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-024", "file": ".github/workflows/dast-zap.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-023", "file": ".github/workflows/sast-opengrep.yml", "cwe": "CWE-829" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 9, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.6154, "f1": 0.6275, "f2": 0.6202, "f2_score": 62.0, "f3": 0.6178, "f3_score": 61.8, "tpr": 0.6154, "fpr": 0.6429, "youden_j": -0.0275, "cvss_coverage": 1.0, "cvss_tp_weight": 111.9, "cvss_fp_weight": 62.5, "cvss_fn_weight": 61.8, "cvss_precision": 0.6416, "cvss_recall": 0.6442, "cvss_f3": 0.644, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 42, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.8077, "f1": 0.4719, "f2": 0.6287, "f2_score": 62.9, "f3": 0.7071, "f3_score": 70.7, "tpr": 0.8077, "fpr": 0.8936, "youden_j": -0.0859, "cvss_coverage": 1.0, "cvss_tp_weight": 144.8, "cvss_fp_weight": 308.0, "cvss_fn_weight": 28.9, "cvss_precision": 0.3198, "cvss_recall": 0.8336, "cvss_f3": 0.7182, "cvss_f3_score": 71.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "medium": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/dashboard.html", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-004", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-021", "file": "db/create_dummy_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/__init__.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-017", "file": "server/api/v1/api_v1.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-019", "file": "server/routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "threatbyte-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "threatbyte-013", "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-018", "file": "server/routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/run.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6282, "recall": 0.3334, "f1": 0.4347, "f2": 0.3675, "f2_score": 36.8, "f3": 0.3496, "f3_score": 34.9, "tpr": 0.3334, "fpr": 0.537, "youden_j": -0.2037, "cvss_coverage": 1.0, "cvss_tp_weight": 58.7, "cvss_fp_weight": 29.9, "cvss_fn_weight": 115.0, "cvss_precision": 0.6703, "cvss_recall": 0.3377, "cvss_f3": 0.3552, "cvss_f3_score": 35.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-11" }, { "classification": "TP", "ground_truth_id": "threatbyte-019", "file": "server/routes.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 6, "fp": 8, "fn": 20, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.2308, "f1": 0.3, "f2": 0.2542, "f2_score": 25.4, "f3": 0.2419, "f3_score": 24.2, "tpr": 0.2308, "fpr": 0.6154, "youden_j": -0.3846, "cvss_coverage": 1.0, "cvss_tp_weight": 39.6, "cvss_fp_weight": 44.8, "cvss_fn_weight": 134.1, "cvss_precision": 0.4691, "cvss_recall": 0.228, "cvss_f3": 0.2403, "cvss_f3_score": 24.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-759" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-006", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-008", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 7, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.4615, "f1": 0.5333, "f2": 0.4878, "f2_score": 48.8, "f3": 0.4743, "f3_score": 47.4, "tpr": 0.4615, "fpr": 0.5833, "youden_j": -0.1218, "cvss_coverage": 1.0, "cvss_tp_weight": 79.7, "cvss_fp_weight": 39.2, "cvss_fn_weight": 94.0, "cvss_precision": 0.6702, "cvss_recall": 0.4588, "cvss_f3": 0.4738, "cvss_f3_score": 47.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-014", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "threatbyte-015", "file": "server/api/v1/api_v1.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "threatbyte-011", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-010", "file": "server/api/v1/api_v1.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "threatbyte-022", "file": "server/api/v1/api_v1.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "threatbyte-005", "file": "server/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/config.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "threatbyte-008", "file": "server/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-009", "file": "server/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-002", "file": "client/templates/dashboard.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "threatbyte-003", "file": "client/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "run.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 20, "fn": 21, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.1923, "f1": 0.1961, "f2": 0.1938, "f2_score": 19.4, "f3": 0.1931, "f3_score": 19.3, "tpr": 0.1923, "fpr": 0.8696, "youden_j": -0.6773, "cvss_coverage": 1.0, "cvss_tp_weight": 35.3, "cvss_fp_weight": 105.0, "cvss_fn_weight": 138.4, "cvss_precision": 0.2516, "cvss_recall": 0.2032, "cvss_f3": 0.2072, "cvss_f3_score": 20.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 2, "fn": 8, "recall": 0.2 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "threatbyte-fp-003", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "threatbyte-012", "file": "server/routes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": "threatbyte-fp-005", "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "threatbyte-007", "file": "server/config.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "threatbyte-016", "file": "server/routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-008", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 14, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1765, "recall": 0.1154, "f1": 0.1395, "f2": 0.124, "f2_score": 12.4, "f3": 0.1195, "f3_score": 12.0, "tpr": 0.1154, "fpr": 0.7778, "youden_j": -0.6624, "cvss_coverage": 1.0, "cvss_tp_weight": 18.6, "cvss_fp_weight": 78.4, "cvss_fn_weight": 155.1, "cvss_precision": 0.1917, "cvss_recall": 0.1071, "cvss_f3": 0.112, "cvss_f3_score": 11.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 1, "fn": 7, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/dashboard.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/edit_profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "client/templates/signup.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "threatbyte-fp-008", "file": "client/templates/upload.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "db/create_dummy_data.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/api/v1/api_v1.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "threatbyte-001", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "threatbyte-fp-003", "file": "server/routes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "threatbyte-006", "file": "server/routes.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-008", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 26, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 173.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "threatbyte-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "threatbyte-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "threatbyte-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-006", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "threatbyte-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "threatbyte-008", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "threatbyte-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "threatbyte-011", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "threatbyte-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "threatbyte-013", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "threatbyte-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "threatbyte-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "threatbyte-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "threatbyte-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "threatbyte-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "threatbyte-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "threatbyte-022", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "threatbyte-023", "file": null, "cwe": "CWE-829" }, { "classification": "FN", "ground_truth_id": "threatbyte-024", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "threatbyte-fp-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-008", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "threatbyte-fp-009", "file": null, "cwe": "CWE-352" } ] } }, "realvuln-vampi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 12, "fp": 3, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.8, "f1": 0.8, "f2": 0.8, "f2_score": 80.0, "f3": 0.8, "f3_score": 80.0, "tpr": 0.8, "fpr": 0.4286, "youden_j": 0.3714, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 16.7, "cvss_fn_weight": 18.2, "cvss_precision": 0.8398, "cvss_recall": 0.828, "cvss_f3": 0.8291, "cvss_f3_score": 82.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 6, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.6667, "f1": 0.6452, "f2": 0.6579, "f2_score": 65.8, "f3": 0.6623, "f3_score": 66.2, "tpr": 0.6667, "fpr": 0.6, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 73.2, "cvss_fp_weight": 28.3, "cvss_fn_weight": 32.6, "cvss_precision": 0.7209, "cvss_recall": 0.6919, "cvss_f3": 0.6947, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 7, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.7333, "f1": 0.6667, "f2": 0.7051, "f2_score": 70.5, "f3": 0.719, "f3_score": 71.9, "tpr": 0.7333, "fpr": 0.6364, "youden_j": 0.097, "cvss_coverage": 1.0, "cvss_tp_weight": 78.5, "cvss_fp_weight": 39.0, "cvss_fn_weight": 27.3, "cvss_precision": 0.6682, "cvss_recall": 0.742, "cvss_f3": 0.7339, "cvss_f3_score": 73.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-116" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 10, "fp": 3, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8236, "recall": 0.7, "f1": 0.7438, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7067, "f3_score": 70.7, "tpr": 0.7, "fpr": 0.3, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 77.5, "cvss_fp_weight": 16.7, "cvss_fn_weight": 28.4, "cvss_precision": 0.8549, "cvss_recall": 0.732, "cvss_f3": 0.7397, "cvss_f3_score": 74.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 13, "fp": 6, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.8667, "f1": 0.7647, "f2": 0.8228, "f2_score": 82.3, "f3": 0.8442, "f3_score": 84.4, "tpr": 0.8667, "fpr": 0.6, "youden_j": 0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 28.3, "cvss_fn_weight": 10.1, "cvss_precision": 0.7715, "cvss_recall": 0.9045, "cvss_f3": 0.8892, "cvss_f3_score": 88.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 7, "fp": 0, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4444, "f1": 0.577, "f2": 0.4879, "f2_score": 48.8, "f3": 0.465, "f3_score": 46.5, "tpr": 0.4444, "fpr": 0.0, "youden_j": 0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 50.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 55.5, "cvss_precision": 1.0, "cvss_recall": 0.4751, "cvss_f3": 0.4949, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 1, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5333, "f1": 0.6667, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5333, "fpr": 0.2, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 57.6, "cvss_fp_weight": 5.6, "cvss_fn_weight": 48.2, "cvss_precision": 0.9118, "cvss_recall": 0.5444, "cvss_f3": 0.5673, "cvss_f3_score": 56.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 13, "fp": 13, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4983, "recall": 0.8667, "f1": 0.6314, "f2": 0.7535, "f2_score": 75.3, "f3": 0.806, "f3_score": 80.6, "tpr": 0.8667, "fpr": 0.764, "youden_j": 0.1027, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 70.9, "cvss_fn_weight": 10.1, "cvss_precision": 0.5771, "cvss_recall": 0.9045, "cvss_f3": 0.8555, "cvss_f3_score": 85.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 12, "fp": 10, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.8, "f1": 0.6486, "f2": 0.7317, "f2_score": 73.2, "f3": 0.7643, "f3_score": 76.4, "tpr": 0.8, "fpr": 0.7143, "youden_j": 0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 40.5, "cvss_fn_weight": 18.2, "cvss_precision": 0.684, "cvss_recall": 0.828, "cvss_f3": 0.8109, "cvss_f3_score": 81.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 13, "fp": 0, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9744, "recall": 0.8445, "f1": 0.9048, "f2": 0.8676, "f2_score": 86.7, "f3": 0.8559, "f3_score": 85.6, "tpr": 0.8445, "fpr": 0.0667, "youden_j": 0.7778, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 1.9, "cvss_fn_weight": 12.8, "cvss_precision": 0.9801, "cvss_recall": 0.879, "cvss_f3": 0.8882, "cvss_f3_score": 88.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 8, "fp": 1, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5333, "f1": 0.6667, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5333, "fpr": 0.2, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 60.2, "cvss_fp_weight": 5.6, "cvss_fn_weight": 45.6, "cvss_precision": 0.9153, "cvss_recall": 0.569, "cvss_f3": 0.5914, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-007", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 15, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 105.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-010", "file": "config.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-015", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 0, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.8667, "f1": 0.9286, "f2": 0.8904, "f2_score": 89.0, "f3": 0.8784, "f3_score": 87.8, "tpr": 0.8667, "fpr": 0.0, "youden_j": 0.8667, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 10.1, "cvss_precision": 1.0, "cvss_recall": 0.9045, "cvss_f3": 0.9133, "cvss_f3_score": 91.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 4, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.7333, "f1": 0.7333, "f2": 0.7333, "f2_score": 73.3, "f3": 0.7333, "f3_score": 73.3, "tpr": 0.7333, "fpr": 0.5, "youden_j": 0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 82.9, "cvss_fp_weight": 22.3, "cvss_fn_weight": 22.9, "cvss_precision": 0.7882, "cvss_recall": 0.7836, "cvss_f3": 0.784, "cvss_f3_score": 78.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/json_schemas.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 15, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 105.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-010", "file": "config.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-015", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 9, "fp": 6, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6085, "recall": 0.6222, "f1": 0.6131, "f2": 0.6179, "f2_score": 61.8, "f3": 0.62, "f3_score": 62.0, "tpr": 0.6222, "fpr": 0.5909, "youden_j": 0.0313, "cvss_coverage": 1.0, "cvss_tp_weight": 68.0, "cvss_fp_weight": 31.7, "cvss_fn_weight": 37.8, "cvss_precision": 0.6793, "cvss_recall": 0.6427, "cvss_f3": 0.6458, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 10, "fp": 4, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7662, "recall": 0.6889, "f1": 0.7094, "f2": 0.6929, "f2_score": 69.3, "f3": 0.6902, "f3_score": 69.0, "tpr": 0.6889, "fpr": 0.4085, "youden_j": 0.2804, "cvss_coverage": 1.0, "cvss_tp_weight": 77.1, "cvss_fp_weight": 22.3, "cvss_fn_weight": 28.7, "cvss_precision": 0.8092, "cvss_recall": 0.7287, "cvss_f3": 0.7319, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 11, "fp": 4, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7431, "recall": 0.7111, "f1": 0.7232, "f2": 0.7152, "f2_score": 71.5, "f3": 0.713, "f3_score": 71.3, "tpr": 0.7111, "fpr": 0.4519, "youden_j": 0.2593, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 18.9, "cvss_fn_weight": 26.2, "cvss_precision": 0.8146, "cvss_recall": 0.7524, "cvss_f3": 0.7578, "cvss_f3_score": 75.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 13, "fp": 2, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.8667, "f1": 0.8667, "f2": 0.8667, "f2_score": 86.7, "f3": 0.8667, "f3_score": 86.7, "tpr": 0.8667, "fpr": 0.3333, "youden_j": 0.5333, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 11.1, "cvss_fn_weight": 10.1, "cvss_precision": 0.8958, "cvss_recall": 0.9045, "cvss_f3": 0.9037, "cvss_f3_score": 90.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 11, "fp": 10, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5238, "recall": 0.7333, "f1": 0.6111, "f2": 0.679, "f2_score": 67.9, "f3": 0.7051, "f3_score": 70.5, "tpr": 0.7333, "fpr": 0.7143, "youden_j": 0.019, "cvss_coverage": 1.0, "cvss_tp_weight": 82.3, "cvss_fp_weight": 72.0, "cvss_fn_weight": 23.5, "cvss_precision": 0.5334, "cvss_recall": 0.7779, "cvss_f3": 0.7438, "cvss_f3_score": 74.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 13, "fp": 36, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2653, "recall": 0.8667, "f1": 0.4062, "f2": 0.5963, "f2_score": 59.6, "f3": 0.7065, "f3_score": 70.7, "tpr": 0.8667, "fpr": 0.9, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 236.5, "cvss_fn_weight": 10.1, "cvss_precision": 0.2881, "cvss_recall": 0.9045, "cvss_f3": 0.7451, "cvss_f3_score": 74.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-257" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-755" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/json_schemas.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "models/books_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 10, "fp": 19, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3448, "recall": 0.6667, "f1": 0.4545, "f2": 0.5618, "f2_score": 56.2, "f3": 0.6098, "f3_score": 61.0, "tpr": 0.6667, "fpr": 0.8261, "youden_j": -0.1594, "cvss_coverage": 1.0, "cvss_tp_weight": 71.0, "cvss_fp_weight": 119.5, "cvss_fn_weight": 34.8, "cvss_precision": 0.3727, "cvss_recall": 0.6711, "cvss_f3": 0.6213, "cvss_f3_score": 62.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-116" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-116" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-476" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-391" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-391" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-391" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 6, "fp": 4, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.4, "f1": 0.48, "f2": 0.4286, "f2_score": 42.9, "f3": 0.4138, "f3_score": 41.4, "tpr": 0.4, "fpr": 0.5, "youden_j": -0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 41.4, "cvss_fp_weight": 35.0, "cvss_fn_weight": 64.4, "cvss_precision": 0.5419, "cvss_recall": 0.3913, "cvss_f3": 0.4025, "cvss_f3_score": 40.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vampi-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-007", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 13, "fp": 36, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2653, "recall": 0.8667, "f1": 0.4062, "f2": 0.5963, "f2_score": 59.6, "f3": 0.7065, "f3_score": 70.7, "tpr": 0.8667, "fpr": 0.9231, "youden_j": -0.0564, "cvss_coverage": 1.0, "cvss_tp_weight": 92.9, "cvss_fp_weight": 281.5, "cvss_fn_weight": 12.9, "cvss_precision": 0.2481, "cvss_recall": 0.8781, "cvss_f3": 0.7003, "cvss_f3_score": 70.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 1, "fn": 1, "recall": 0.8333 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vampi-fp-001", "file": "api_views/users.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-015", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 13, "fp": 8, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.8667, "f1": 0.7222, "f2": 0.8025, "f2_score": 80.2, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.8667, "fpr": 0.6667, "youden_j": 0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 91.4, "cvss_fp_weight": 56.5, "cvss_fn_weight": 14.4, "cvss_precision": 0.618, "cvss_recall": 0.8639, "cvss_f3": 0.8308, "cvss_f3_score": 83.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-015", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-010", "file": "config.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 12, "fp": 15, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.8, "f1": 0.5714, "f2": 0.6897, "f2_score": 69.0, "f3": 0.7407, "f3_score": 74.1, "tpr": 0.8, "fpr": 0.7895, "youden_j": 0.0105, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 116.0, "cvss_fn_weight": 18.2, "cvss_precision": 0.4303, "cvss_recall": 0.828, "cvss_f3": 0.7579, "cvss_f3_score": 75.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 14, "fp": 43, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2456, "recall": 0.9333, "f1": 0.3889, "f2": 0.5983, "f2_score": 59.8, "f3": 0.7292, "f3_score": 72.9, "tpr": 0.9333, "fpr": 0.9348, "youden_j": -0.0014, "cvss_coverage": 1.0, "cvss_tp_weight": 101.0, "cvss_fp_weight": 320.0, "cvss_fn_weight": 4.8, "cvss_precision": 0.2399, "cvss_recall": 0.9546, "cvss_f3": 0.7355, "cvss_f3_score": 73.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-011", "file": "api_views/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-013", "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vampi-fp-001", "file": "api_views/users.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-015", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-012", "file": "models/user_model.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 7, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6235, "recall": 0.6222, "f1": 0.6146, "f2": 0.6167, "f2_score": 61.7, "f3": 0.619, "f3_score": 61.9, "tpr": 0.6222, "fpr": 0.5644, "youden_j": 0.0578, "cvss_coverage": 1.0, "cvss_tp_weight": 68.5, "cvss_fp_weight": 33.7, "cvss_fn_weight": 37.3, "cvss_precision": 0.7026, "cvss_recall": 0.6478, "cvss_f3": 0.6504, "cvss_f3_score": 65.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 5, "fp": 9, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3571, "recall": 0.3333, "f1": 0.3448, "f2": 0.3378, "f2_score": 33.8, "f3": 0.3356, "f3_score": 33.6, "tpr": 0.3333, "fpr": 0.6923, "youden_j": -0.359, "cvss_coverage": 1.0, "cvss_tp_weight": 35.5, "cvss_fp_weight": 45.0, "cvss_fn_weight": 70.3, "cvss_precision": 0.4407, "cvss_recall": 0.3355, "cvss_f3": 0.3437, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "openapi_specs/openapi3.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 8, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.6667, "f1": 0.6061, "f2": 0.641, "f2_score": 64.1, "f3": 0.6536, "f3_score": 65.4, "tpr": 0.6667, "fpr": 0.6667, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 73.2, "cvss_fp_weight": 34.4, "cvss_fn_weight": 32.6, "cvss_precision": 0.6802, "cvss_recall": 0.6919, "cvss_f3": 0.6907, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-001", "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vampi-004", "file": "api_views/users.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vampi-005", "file": "api_views/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vampi-006", "file": "api_views/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views/users.py", "cwe": "CWE-198" }, { "classification": "TP", "ground_truth_id": "vampi-003", "file": "api_views/books.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vampi-002", "file": "api_views/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "openapi_specs/openapi3.yml", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vampi-008", "file": "config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vampi-007", "file": "api_views/users.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vampi-014", "file": "models/user_model.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "openapi_specs/openapi3.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "rowan": { "scanner": "rowan", "tp": 1, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.0667, "f1": 0.0952, "f2": 0.0758, "f2_score": 7.6, "f3": 0.0709, "f3_score": 7.1, "tpr": 0.0667, "fpr": 0.5556, "youden_j": -0.4889, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 17.5, "cvss_fn_weight": 99.9, "cvss_precision": 0.2521, "cvss_recall": 0.0558, "cvss_f3": 0.0605, "cvss_f3_score": 6.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vampi-009", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "models/user_model.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vampi-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-007", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 0, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 105.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vampi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vampi-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-007", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vampi-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 105.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vampi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vampi-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vampi-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vampi-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vampi-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vampi-007", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vampi-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vampi-010", "file": null, "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vampi-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vampi-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vampi-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vampi-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vampi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vampi-fp-004", "file": null, "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vampi-014", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vampi-015", "file": null, "cwe": "CWE-209" } ] } }, "realvuln-vfapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 9, "fp": 4, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 1.0, "f1": 0.8182, "f2": 0.9184, "f2_score": 91.8, "f3": 0.9574, "f3_score": 95.7, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 20.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.7815, "cvss_recall": 1.0, "cvss_f3": 0.9728, "cvss_f3_score": 97.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 2, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.8889, "f1": 0.8421, "f2": 0.8696, "f2_score": 87.0, "f3": 0.8791, "f3_score": 87.9, "tpr": 0.8889, "fpr": 0.5, "youden_j": 0.3889, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 7.2, "cvss_fn_weight": 7.5, "cvss_precision": 0.9019, "cvss_recall": 0.898, "cvss_f3": 0.8983, "cvss_f3_score": 89.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 8, "fp": 4, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6616, "recall": 0.8519, "f1": 0.7445, "f2": 0.8053, "f2_score": 80.5, "f3": 0.8279, "f3_score": 82.8, "tpr": 0.8519, "fpr": 0.6825, "youden_j": 0.1693, "cvss_coverage": 1.0, "cvss_tp_weight": 63.1, "cvss_fp_weight": 24.7, "cvss_fn_weight": 10.4, "cvss_precision": 0.7202, "cvss_recall": 0.8585, "cvss_f3": 0.8422, "cvss_f3_score": 84.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 2, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.775, "recall": 0.7408, "f1": 0.7554, "f2": 0.7461, "f2_score": 74.6, "f3": 0.7433, "f3_score": 74.3, "tpr": 0.7408, "fpr": 0.4778, "youden_j": 0.263, "cvss_coverage": 1.0, "cvss_tp_weight": 56.9, "cvss_fp_weight": 11.3, "cvss_fn_weight": 16.6, "cvss_precision": 0.8417, "cvss_recall": 0.7737, "cvss_f3": 0.7788, "cvss_f3_score": 77.9, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 3, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 1.0, "f1": 0.8571, "f2": 0.9375, "f2_score": 93.8, "f3": 0.9677, "f3_score": 96.8, "tpr": 1.0, "fpr": 0.6, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 20.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.7857, "cvss_recall": 1.0, "cvss_f3": 0.9735, "cvss_f3_score": 97.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 0, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.6667, "f1": 0.7964, "f2": 0.7127, "f2_score": 71.3, "f3": 0.6889, "f3_score": 68.9, "tpr": 0.6667, "fpr": 0.0, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 49.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 23.6, "cvss_precision": 1.0, "cvss_recall": 0.6785, "cvss_f3": 0.7003, "cvss_f3_score": 70.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 9, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 73.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vfapi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 8, "fp": 10, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4454, "recall": 0.8889, "f1": 0.5931, "f2": 0.7409, "f2_score": 74.1, "f3": 0.8081, "f3_score": 80.8, "tpr": 0.8889, "fpr": 0.8326, "youden_j": 0.0563, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 64.7, "cvss_fn_weight": 7.5, "cvss_precision": 0.5058, "cvss_recall": 0.898, "cvss_f3": 0.8331, "cvss_f3_score": 83.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 9, "fp": 2, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8476, "recall": 1.0, "f1": 0.91, "f2": 0.9594, "f2_score": 95.9, "f3": 0.9788, "f3_score": 97.9, "tpr": 1.0, "fpr": 0.3492, "youden_j": 0.6508, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 13.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.8681, "cvss_recall": 1.0, "cvss_f3": 0.9825, "cvss_f3_score": 98.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 9, "fp": 2, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8238, "recall": 0.963, "f1": 0.881, "f2": 0.9261, "f2_score": 92.6, "f3": 0.9437, "f3_score": 94.4, "tpr": 0.963, "fpr": 0.3611, "youden_j": 0.6019, "cvss_coverage": 1.0, "cvss_tp_weight": 71.0, "cvss_fp_weight": 15.6, "cvss_fn_weight": 2.5, "cvss_precision": 0.8463, "cvss_recall": 0.966, "cvss_f3": 0.9503, "cvss_f3_score": 95.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 9, "fp": 2, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 1.0, "f1": 0.9, "f2": 0.9574, "f2_score": 95.7, "f3": 0.9783, "f3_score": 97.8, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 13.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.8462, "cvss_recall": 1.0, "cvss_f3": 0.9821, "cvss_f3_score": 98.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 8, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.8889, "f1": 0.9412, "f2": 0.9091, "f2_score": 90.9, "f3": 0.8989, "f3_score": 89.9, "tpr": 0.8889, "fpr": 0.0, "youden_j": 0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 7.5, "cvss_precision": 1.0, "cvss_recall": 0.898, "cvss_f3": 0.9072, "cvss_f3_score": 90.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 7, "fp": 0, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.7778, "f1": 0.875, "f2": 0.814, "f2_score": 81.4, "f3": 0.7955, "f3_score": 79.5, "tpr": 0.7778, "fpr": 0.0, "youden_j": 0.7778, "cvss_coverage": 1.0, "cvss_tp_weight": 57.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 15.6, "cvss_precision": 1.0, "cvss_recall": 0.7878, "cvss_f3": 0.8048, "cvss_f3_score": 80.5, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 9, "fp": 0, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 8, "fp": 1, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.8889, "f1": 0.8889, "f2": 0.8889, "f2_score": 88.9, "f3": 0.8889, "f3_score": 88.9, "tpr": 0.8889, "fpr": 0.3333, "youden_j": 0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 6.7, "cvss_fn_weight": 7.5, "cvss_precision": 0.9081, "cvss_recall": 0.898, "cvss_f3": 0.899, "cvss_f3_score": 89.9, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 8, "fp": 2, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.8889, "f1": 0.8421, "f2": 0.8696, "f2_score": 87.0, "f3": 0.8791, "f3_score": 87.9, "tpr": 0.8889, "fpr": 0.5, "youden_j": 0.3889, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 13.4, "cvss_fn_weight": 7.5, "cvss_precision": 0.8316, "cvss_recall": 0.898, "cvss_f3": 0.8909, "cvss_f3_score": 89.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 9, "fp": 0, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 8, "fp": 4, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.6869, "recall": 0.8889, "f1": 0.7746, "f2": 0.8392, "f2_score": 83.9, "f3": 0.8633, "f3_score": 86.3, "tpr": 0.8889, "fpr": 0.7389, "youden_j": 0.15, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 20.3, "cvss_fn_weight": 7.5, "cvss_precision": 0.7641, "cvss_recall": 0.898, "cvss_f3": 0.8825, "cvss_f3_score": 88.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 1, "fn": 0, "precision": 0.8333, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "vfapi-fp-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 8, "fp": 0, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.9667, "recall": 0.9259, "f1": 0.9433, "f2": 0.9322, "f2_score": 93.2, "f3": 0.9289, "f3_score": 92.9, "tpr": 0.9259, "fpr": 0.1111, "youden_j": 0.8148, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 2.2, "cvss_fn_weight": 3.9, "cvss_precision": 0.9722, "cvss_recall": 0.9465, "cvss_f3": 0.9485, "cvss_f3_score": 94.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 8, "fp": 3, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7628, "recall": 0.9259, "f1": 0.8312, "f2": 0.8839, "f2_score": 88.4, "f3": 0.9041, "f3_score": 90.4, "tpr": 0.9259, "fpr": 0.45, "youden_j": 0.4759, "cvss_coverage": 1.0, "cvss_tp_weight": 69.0, "cvss_fp_weight": 18.0, "cvss_fn_weight": 4.5, "cvss_precision": 0.8137, "cvss_recall": 0.9392, "cvss_f3": 0.9235, "cvss_f3_score": 92.3, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 9, "fp": 0, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 6, "fp": 1, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.6667, "f1": 0.75, "f2": 0.6977, "f2_score": 69.8, "f3": 0.6818, "f3_score": 68.2, "tpr": 0.6667, "fpr": 0.3333, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 48.8, "cvss_fp_weight": 5.5, "cvss_fn_weight": 24.7, "cvss_precision": 0.8987, "cvss_recall": 0.6639, "cvss_f3": 0.6818, "cvss_f3_score": 68.2, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 8, "fp": 24, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.8889, "f1": 0.3902, "f2": 0.5882, "f2_score": 58.8, "f3": 0.708, "f3_score": 70.8, "tpr": 0.8889, "fpr": 0.9231, "youden_j": -0.0342, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 164.5, "cvss_fn_weight": 7.5, "cvss_precision": 0.2863, "cvss_recall": 0.898, "cvss_f3": 0.7399, "cvss_f3_score": 74.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "run.sh", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "static/robots.txt", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 8, "fp": 12, "fn": 1, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.8889, "f1": 0.5517, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7921, "f3_score": 79.2, "tpr": 0.8889, "fpr": 0.8571, "youden_j": 0.0317, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 77.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.4615, "cvss_recall": 0.898, "cvss_f3": 0.8204, "cvss_f3_score": 82.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 0, "fp": 0, "fn": 9, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 73.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vfapi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 9, "fp": 16, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 1.0, "f1": 0.5294, "f2": 0.7377, "f2_score": 73.8, "f3": 0.8491, "f3_score": 84.9, "tpr": 1.0, "fpr": 0.8889, "youden_j": 0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 134.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.3542, "cvss_recall": 1.0, "cvss_f3": 0.8458, "cvss_f3_score": 84.6, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "ui/src/template.html", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 9, "fp": 10, "fn": 0, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.4737, "recall": 1.0, "f1": 0.6429, "f2": 0.8182, "f2_score": 81.8, "f3": 0.9, "f3_score": 90.0, "tpr": 1.0, "fpr": 0.9091, "youden_j": 0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 77.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.4868, "cvss_recall": 1.0, "cvss_f3": 0.9046, "cvss_f3_score": 90.5, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 1, "fn": 0, "precision": 0.8333, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": "vfapi-fp-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 6, "fp": 7, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.6667, "f1": 0.5455, "f2": 0.6122, "f2_score": 61.2, "f3": 0.6383, "f3_score": 63.8, "tpr": 0.6667, "fpr": 0.7778, "youden_j": -0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 48.8, "cvss_fp_weight": 39.0, "cvss_fn_weight": 24.7, "cvss_precision": 0.5558, "cvss_recall": 0.6639, "cvss_f3": 0.6513, "cvss_f3_score": 65.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 9, "fp": 19, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3214, "recall": 1.0, "f1": 0.4865, "f2": 0.7031, "f2_score": 70.3, "f3": 0.8257, "f3_score": 82.6, "tpr": 1.0, "fpr": 0.9048, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 73.5, "cvss_fp_weight": 150.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.3281, "cvss_recall": 1.0, "cvss_f3": 0.83, "cvss_f3_score": 83.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vfapi-009", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "ui/src/template.html", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 6, "fp": 6, "fn": 3, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.5175, "recall": 0.6667, "f1": 0.5818, "f2": 0.6296, "f2_score": 62.9, "f3": 0.6476, "f3_score": 64.7, "tpr": 0.6667, "fpr": 0.8889, "youden_j": -0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 49.9, "cvss_fp_weight": 31.7, "cvss_fn_weight": 23.6, "cvss_precision": 0.6118, "cvss_recall": 0.6785, "cvss_f3": 0.6711, "cvss_f3_score": 67.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 2, "fn": 0, "precision": 0.7143, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 5, "fp": 2, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "vfapi-fp-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": "vfapi-fp-001", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 5, "fp": 6, "fn": 4, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.5556, "f1": 0.5, "f2": 0.5319, "f2_score": 53.2, "f3": 0.5435, "f3_score": 54.3, "tpr": 0.5556, "fpr": 0.8571, "youden_j": -0.3016, "cvss_coverage": 1.0, "cvss_tp_weight": 42.6, "cvss_fp_weight": 33.9, "cvss_fn_weight": 30.9, "cvss_precision": 0.5568, "cvss_recall": 0.5796, "cvss_f3": 0.5772, "cvss_f3_score": 57.7, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 1, "fn": 1, "precision": 0.8, "recall": 0.8 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 1, "fn": 2, "recall": 0.6667 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": "vfapi-fp-001", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 8, "fp": 2, "fn": 1, "tn": 1, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.8889, "f1": 0.8421, "f2": 0.8696, "f2_score": 87.0, "f3": 0.8791, "f3_score": 87.9, "tpr": 0.8889, "fpr": 0.6667, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 65.4, "cvss_fp_weight": 7.2, "cvss_fn_weight": 8.1, "cvss_precision": 0.9011, "cvss_recall": 0.8898, "cvss_f3": 0.8909, "cvss_f3_score": 89.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 1, "fn": 0, "precision": 0.8333, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 1, "fn": 1, "recall": 0.8333 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-001", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-002", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-004", "file": "main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vfapi-005", "file": "main.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": "vfapi-fp-001", "file": "main.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vfapi-008", "file": "main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vfapi-006", "file": "main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 2, "fp": 6, "fn": 7, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.2222, "f1": 0.2353, "f2": 0.2273, "f2_score": 22.7, "f3": 0.2247, "f3_score": 22.5, "tpr": 0.2222, "fpr": 0.75, "youden_j": -0.5278, "cvss_coverage": 1.0, "cvss_tp_weight": 15.3, "cvss_fp_weight": 15.5, "cvss_fn_weight": 58.2, "cvss_precision": 0.4968, "cvss_recall": 0.2082, "cvss_f3": 0.221, "cvss_f3_score": 22.1, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vfapi-003", "file": "main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/redoc.standalone.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/swagger-ui-bundle.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "ui/static/js/mui.min.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "ui/static/js/yokto.min.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vfapi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 0, "fn": 8, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.1111, "f1": 0.2, "f2": 0.1351, "f2_score": 13.5, "f3": 0.122, "f3_score": 12.2, "tpr": 0.1111, "fpr": 0.0, "youden_j": 0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 67.6, "cvss_precision": 1.0, "cvss_recall": 0.0803, "cvss_f3": 0.0884, "cvss_f3_score": 8.8, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vfapi-007", "file": "main.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vfapi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 9, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 73.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vfapi-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vfapi-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vfapi-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vfapi-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vfapi-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vfapi-009", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-001", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vfapi-fp-002", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-vuln-node-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 4, "fp": 1, "fn": 1, "tn": 0, "ns": 2, "ns_gt": 4, "precision": 0.8, "recall": 0.8, "f1": 0.8, "f2": 0.8, "f2_score": 80.0, "f3": 0.8, "f3_score": 80.0, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 27.3, "cvss_fp_weight": 0.5, "cvss_fn_weight": 5.3, "cvss_precision": 0.982, "cvss_recall": 0.8374, "cvss_f3": 0.8499, "cvss_f3_score": 85.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": "bootstrapdb.js", "cwe": "CWE-256" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": "bootstrapdb.js", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-006", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 4, "fp": 3, "fn": 1, "tn": 0, "ns": 1, "ns_gt": 4, "precision": 0.5714, "recall": 0.8, "f1": 0.6667, "f2": 0.7407, "f2_score": 74.1, "f3": 0.7692, "f3_score": 76.9, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 27.3, "cvss_fp_weight": 19.6, "cvss_fn_weight": 5.3, "cvss_precision": 0.5826, "cvss_recall": 0.8374, "cvss_f3": 0.8023, "cvss_f3_score": 80.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-006", "file": "routes/api.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": "bootstrapdb.js", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-008", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 3, "fp": 0, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 1.0, "recall": 0.6, "f1": 0.75, "f2": 0.6522, "f2_score": 65.2, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6, "fpr": 0.0, "youden_j": 0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 22.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 10.6, "cvss_precision": 1.0, "cvss_recall": 0.6748, "cvss_f3": 0.6975, "cvss_f3_score": 69.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-008", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 5, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 32.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-006", "file": "routes/api.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 5, "fp": 1, "fn": 0, "tn": 0, "ns": 1, "ns_gt": 4, "precision": 0.8333, "recall": 1.0, "f1": 0.9091, "f2": 0.9615, "f2_score": 96.2, "f3": 0.9804, "f3_score": 98.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 32.6, "cvss_fp_weight": 0.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.9849, "cvss_recall": 1.0, "cvss_f3": 0.9985, "cvss_f3_score": 99.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": "bootstrapdb.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-006", "file": "routes/api.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 5, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 32.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-001", "file": "bootstrapdb.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-006", "file": "routes/api.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 2, "fp": 1, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.6667, "recall": 0.4, "f1": 0.5, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4167, "f3_score": 41.7, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 12.9, "cvss_fp_weight": 6.5, "cvss_fn_weight": 19.7, "cvss_precision": 0.6643, "cvss_recall": 0.3957, "cvss_f3": 0.4124, "cvss_f3_score": 41.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-008", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 3, "fp": 0, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 1.0, "recall": 0.6, "f1": 0.75, "f2": 0.6522, "f2_score": 65.2, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6, "fpr": 0.0, "youden_j": 0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 18.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 14.4, "cvss_precision": 1.0, "cvss_recall": 0.5583, "cvss_f3": 0.5841, "cvss_f3_score": 58.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-006", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 4, "fp": 5, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.4444, "recall": 0.8, "f1": 0.5714, "f2": 0.6897, "f2_score": 69.0, "f3": 0.7407, "f3_score": 74.1, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 23.5, "cvss_fp_weight": 30.0, "cvss_fn_weight": 9.1, "cvss_precision": 0.4393, "cvss_recall": 0.7209, "cvss_f3": 0.6774, "cvss_f3_score": 67.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-006", "file": "routes/api.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-007", "file": "service/search.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-008", "file": "views/error.pug", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "azure-pipelines.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 5, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.1667, "recall": 0.2, "f1": 0.1818, "f2": 0.1923, "f2_score": 19.2, "f3": 0.1961, "f3_score": 19.6, "tpr": 0.2, "fpr": 1.0, "youden_j": -0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 14.5, "cvss_fn_weight": 27.2, "cvss_precision": 0.2708, "cvss_recall": 0.1656, "cvss_f3": 0.1723, "cvss_f3_score": 17.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/api.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-009", "file": "views/searchResult.pug", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-008", "file": null, "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-005", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "realvuln-vuln-node-express-swagger": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 17, "fn": 33, "tn": 0, "ns": 3, "ns_gt": 3, "precision": 0.4848, "recall": 0.3265, "f1": 0.3902, "f2": 0.3493, "f2_score": 34.9, "f3": 0.3376, "f3_score": 33.8, "tpr": 0.3265, "fpr": 1.0, "youden_j": -0.6735, "cvss_coverage": 1.0, "cvss_tp_weight": 115.4, "cvss_fp_weight": 106.0, "cvss_fn_weight": 207.6, "cvss_precision": 0.5213, "cvss_recall": 0.3573, "cvss_f3": 0.3689, "cvss_f3_score": 36.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 25, "recall": 0.3902 }, "low": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-002", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-434" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-043", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-046", "file": "src/server.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-051", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-052", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 23, "fn": 33, "tn": 0, "ns": 6, "ns_gt": 3, "precision": 0.4103, "recall": 0.3265, "f1": 0.3636, "f2": 0.3404, "f2_score": 34.0, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.3265, "fpr": 1.0, "youden_j": -0.6735, "cvss_coverage": 1.0, "cvss_tp_weight": 112.2, "cvss_fp_weight": 139.4, "cvss_fn_weight": 210.8, "cvss_precision": 0.4459, "cvss_recall": 0.3474, "cvss_f3": 0.3552, "cvss_f3_score": 35.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 25, "recall": 0.3902 }, "low": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-002", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-345" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-261" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/index.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-038", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-046", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 12, "fn": 38, "tn": 0, "ns": 2, "ns_gt": 3, "precision": 0.4783, "recall": 0.2245, "f1": 0.3056, "f2": 0.2511, "f2_score": 25.1, "f3": 0.2371, "f3_score": 23.7, "tpr": 0.2245, "fpr": 1.0, "youden_j": -0.7755, "cvss_coverage": 1.0, "cvss_tp_weight": 83.1, "cvss_fp_weight": 73.0, "cvss_fn_weight": 239.9, "cvss_precision": 0.5323, "cvss_recall": 0.2573, "cvss_f3": 0.2713, "cvss_f3_score": 27.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 30, "recall": 0.2683 }, "low": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-025", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/index.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-002", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-008", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-046", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-051", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-052", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 17, "fn": 34, "tn": 0, "ns": 3, "ns_gt": 3, "precision": 0.4688, "recall": 0.3061, "f1": 0.3704, "f2": 0.3289, "f2_score": 32.9, "f3": 0.3171, "f3_score": 31.7, "tpr": 0.3061, "fpr": 1.0, "youden_j": -0.6939, "cvss_coverage": 1.0, "cvss_tp_weight": 100.7, "cvss_fp_weight": 106.0, "cvss_fn_weight": 222.3, "cvss_precision": 0.4873, "cvss_recall": 0.3118, "cvss_f3": 0.3234, "cvss_f3_score": 32.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 26, "recall": 0.3659 }, "low": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-035", "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/verifySignup.js", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-002", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-008", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-046", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-051", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 24, "fp": 39, "fn": 25, "tn": 0, "ns": 8, "ns_gt": 3, "precision": 0.381, "recall": 0.4898, "f1": 0.4286, "f2": 0.4633, "f2_score": 46.3, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4898, "fpr": 1.0, "youden_j": -0.5102, "cvss_coverage": 1.0, "cvss_tp_weight": 156.7, "cvss_fp_weight": 220.5, "cvss_fn_weight": 166.3, "cvss_precision": 0.4154, "cvss_recall": 0.4851, "cvss_f3": 0.4771, "cvss_f3_score": 47.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 18, "recall": 0.561 }, "low": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-015", "file": "src/router/routes/order.js", "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-021", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-027", "file": "src/router/routes/user.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-284" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-035", "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-288" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-613" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-034", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-010", "file": "src/router/routes/frontend.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-049", "file": "src/templates/beer.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-046", "file": "src/server.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-047", "file": "src/server.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/index.js", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-002", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-008", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 48, "fp": 13, "fn": 1, "tn": 0, "ns": 5, "ns_gt": 3, "precision": 0.7869, "recall": 0.9796, "f1": 0.8727, "f2": 0.9339, "f2_score": 93.4, "f3": 0.9562, "f3_score": 95.6, "tpr": 0.9796, "fpr": 1.0, "youden_j": -0.0204, "cvss_coverage": 1.0, "cvss_tp_weight": 317.7, "cvss_fp_weight": 85.7, "cvss_fn_weight": 5.3, "cvss_precision": 0.7876, "cvss_recall": 0.9836, "cvss_f3": 0.9597, "cvss_f3_score": 96.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 1, "recall": 0.9756 }, "low": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-001", "file": "package.json", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-002", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-003", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-004", "file": "src/router/routes/admin.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-006", "file": "src/router/routes/admin.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-010", "file": "src/router/routes/frontend.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-011", "file": "src/router/routes/frontend.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-015", "file": "src/router/routes/order.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-020", "file": "src/router/routes/system.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-021", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-023", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-024", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-025", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-026", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-029", "file": "src/router/routes/user.js", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-028", "file": "src/router/routes/user.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-030", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-031", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-032", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-033", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-034", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-035", "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-037", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-039", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-040", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-042", "file": "src/router/routes/user.js", "cwe": "CWE-304" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-043", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-046", "file": "src/server.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-047", "file": "src/server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-048", "file": "src/server.js", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-049", "file": "src/templates/beer.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 21, "fp": 21, "fn": 28, "tn": 0, "ns": 2, "ns_gt": 3, "precision": 0.5, "recall": 0.4286, "f1": 0.4615, "f2": 0.4412, "f2_score": 44.1, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 150.8, "cvss_fp_weight": 132.3, "cvss_fn_weight": 172.2, "cvss_precision": 0.5326, "cvss_recall": 0.4669, "cvss_f3": 0.4727, "cvss_f3_score": 47.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 21, "recall": 0.4878 }, "low": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-021", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-039", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-002", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-836" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-047", "file": "src/server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-015", "file": "src/router/routes/order.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "package.json", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-046", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 23, "fp": 34, "fn": 26, "tn": 0, "ns": 7, "ns_gt": 3, "precision": 0.4035, "recall": 0.4694, "f1": 0.434, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4618, "f3_score": 46.2, "tpr": 0.4694, "fpr": 1.0, "youden_j": -0.5306, "cvss_coverage": 1.0, "cvss_tp_weight": 154.9, "cvss_fp_weight": 187.6, "cvss_fn_weight": 168.1, "cvss_precision": 0.4523, "cvss_recall": 0.4796, "cvss_f3": 0.4767, "cvss_f3_score": 47.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 21, "recall": 0.4878 }, "low": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-352" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-038", "file": "src/router/routes/user.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-043", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-040", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-046", "file": "src/server.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-044", "file": "src/server.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-015", "file": "src/router/routes/order.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-006", "file": "src/router/routes/admin.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-020", "file": "src/router/routes/system.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "package.json", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-002", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 43, "fp": 32, "fn": 6, "tn": 0, "ns": 7, "ns_gt": 3, "precision": 0.5733, "recall": 0.8776, "f1": 0.6935, "f2": 0.7934, "f2_score": 79.3, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.8776, "fpr": 1.0, "youden_j": -0.1224, "cvss_coverage": 1.0, "cvss_tp_weight": 287.1, "cvss_fp_weight": 243.5, "cvss_fn_weight": 35.9, "cvss_precision": 0.5411, "cvss_recall": 0.8889, "cvss_f3": 0.8352, "cvss_f3_score": 83.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 8, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 6, "recall": 0.8537 }, "low": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-001", "file": "package.json", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/verifySignup.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/verifySignup.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-004", "file": "src/router/routes/admin.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-006", "file": "src/router/routes/admin.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-009", "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-012", "file": "src/router/routes/order.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-015", "file": "src/router/routes/order.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-019", "file": "src/router/routes/system.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-020", "file": "src/router/routes/system.js", "cwe": "CWE-209" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-023", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-026", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-028", "file": "src/router/routes/user.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-031", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-033", "file": "src/router/routes/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-034", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-035", "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-916" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-040", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-043", "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/auth-login-basic.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-049", "file": "src/templates/beer.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-050", "file": "src/templates/profile.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-051", "file": "src/templates/user-register.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-052", "file": "src/templates/user.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-330" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-045", "file": "src/server.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-046", "file": "src/server.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-027", "file": "src/router/routes/user.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-042", "file": "src/router/routes/user.js", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-021", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-047", "file": "src/server.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-002", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-003", "file": "src/router/routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-010", "file": "src/router/routes/frontend.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-024", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-025", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-032", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-037", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-039", "file": "src/router/routes/user.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-038", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 8, "fp": 33, "fn": 41, "tn": 0, "ns": 3, "ns_gt": 3, "precision": 0.1951, "recall": 0.1633, "f1": 0.1778, "f2": 0.1688, "f2_score": 16.9, "f3": 0.166, "f3_score": 16.6, "tpr": 0.1633, "fpr": 1.0, "youden_j": -0.8367, "cvss_coverage": 1.0, "cvss_tp_weight": 68.3, "cvss_fp_weight": 181.0, "cvss_fn_weight": 254.7, "cvss_precision": 0.274, "cvss_recall": 0.2115, "cvss_f3": 0.2164, "cvss_f3_score": 21.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 33, "recall": 0.1951 }, "low": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "populate.sh", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/authJwt.js", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/admin.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-005", "file": "src/router/routes/admin.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-007", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-008", "file": "src/router/routes/frontend.js", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/frontend.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-013", "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-014", "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/order.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-016", "file": "src/router/routes/system.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-017", "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vuln-node-express-swagger-018", "file": "src/router/routes/system.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/system.js", "cwe": "CWE-117" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-601" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": "src/router/routes/user.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/router/routes/user.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/auth-login-basic.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/auth-register-basic.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/beer.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/cards-basic.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/layouts-without-menu.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/profile.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/ui-carousel.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/user-register.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/templates/user.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-001", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-002", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-006", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-015", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-023", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-026", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-028", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-033", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-034", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-035", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-037", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-038", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-040", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-042", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-043", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-046", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-047", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-048", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-051", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vuln-node-express-swagger-052", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-022", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-036", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vuln-node-express-swagger-041", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "realvuln-vulnerable-api": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 11, "fp": 8, "fn": 3, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.7857, "f1": 0.6667, "f2": 0.7333, "f2_score": 73.3, "f3": 0.7586, "f3_score": 75.9, "tpr": 0.7857, "fpr": 0.8, "youden_j": -0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 78.7, "cvss_fp_weight": 46.6, "cvss_fn_weight": 20.3, "cvss_precision": 0.6282, "cvss_recall": 0.7949, "cvss_f3": 0.7744, "cvss_f3_score": 77.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-002", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "swagger.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 1, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.7143, "f1": 0.8, "f2": 0.7463, "f2_score": 74.6, "f3": 0.7299, "f3_score": 73.0, "tpr": 0.7143, "fpr": 0.25, "youden_j": 0.4643, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 5.8, "cvss_fn_weight": 27.8, "cvss_precision": 0.9244, "cvss_recall": 0.7192, "cvss_f3": 0.7355, "cvss_f3_score": 73.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-007", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "swagger.yml", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-006", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 2, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8252, "recall": 0.7381, "f1": 0.7759, "f2": 0.7521, "f2_score": 75.2, "f3": 0.7449, "f3_score": 74.5, "tpr": 0.7381, "fpr": 0.4405, "youden_j": 0.2976, "cvss_coverage": 1.0, "cvss_tp_weight": 73.0, "cvss_fp_weight": 13.6, "cvss_fn_weight": 26.0, "cvss_precision": 0.8501, "cvss_recall": 0.737, "cvss_f3": 0.7462, "cvss_f3_score": 74.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 9, "fp": 1, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8778, "recall": 0.6667, "f1": 0.7564, "f2": 0.6996, "f2_score": 70.0, "f3": 0.6827, "f3_score": 68.3, "tpr": 0.6667, "fpr": 0.3, "youden_j": 0.3667, "cvss_coverage": 1.0, "cvss_tp_weight": 66.7, "cvss_fp_weight": 6.0, "cvss_fn_weight": 32.3, "cvss_precision": 0.9175, "cvss_recall": 0.6734, "cvss_f3": 0.6917, "cvss_f3_score": 69.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 0, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5714, "f1": 0.7273, "f2": 0.625, "f2_score": 62.5, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5714, "fpr": 0.0, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 60.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 38.9, "cvss_precision": 1.0, "cvss_recall": 0.6071, "cvss_f3": 0.6319, "cvss_f3_score": 63.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 0, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9524, "recall": 0.4524, "f1": 0.6127, "f2": 0.5052, "f2_score": 50.5, "f3": 0.4773, "f3_score": 47.7, "tpr": 0.4524, "fpr": 0.1111, "youden_j": 0.3413, "cvss_coverage": 1.0, "cvss_tp_weight": 47.0, "cvss_fp_weight": 1.9, "cvss_fn_weight": 52.0, "cvss_precision": 0.9614, "cvss_recall": 0.4748, "cvss_f3": 0.4999, "cvss_f3_score": 50.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 6, "fp": 0, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4286, "f1": 0.6, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4286, "fpr": 0.0, "youden_j": 0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 44.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 54.5, "cvss_precision": 1.0, "cvss_recall": 0.4495, "cvss_f3": 0.4757, "cvss_f3_score": 47.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 8, "fp": 1, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8593, "recall": 0.5476, "f1": 0.6676, "f2": 0.5899, "f2_score": 59.0, "f3": 0.5679, "f3_score": 56.8, "tpr": 0.5476, "fpr": 0.2667, "youden_j": 0.2809, "cvss_coverage": 1.0, "cvss_tp_weight": 55.0, "cvss_fp_weight": 7.7, "cvss_fn_weight": 44.0, "cvss_precision": 0.8823, "cvss_recall": 0.5556, "cvss_f3": 0.5767, "cvss_f3_score": 57.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 9, "fp": 1, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9111, "recall": 0.6667, "f1": 0.7673, "f2": 0.7031, "f2_score": 70.3, "f3": 0.6844, "f3_score": 68.5, "tpr": 0.6667, "fpr": 0.2167, "youden_j": 0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 4.0, "cvss_fn_weight": 33.0, "cvss_precision": 0.9446, "cvss_recall": 0.6667, "cvss_f3": 0.6865, "cvss_f3_score": 68.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 10, "fp": 3, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7891, "recall": 0.7143, "f1": 0.7453, "f2": 0.7253, "f2_score": 72.5, "f3": 0.7196, "f3_score": 72.0, "tpr": 0.7143, "fpr": 0.4389, "youden_j": 0.2754, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 6.8, "cvss_fn_weight": 27.8, "cvss_precision": 0.9169, "cvss_recall": 0.7192, "cvss_f3": 0.7348, "cvss_f3_score": 73.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-007", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-006", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 10, "fp": 6, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.7143, "f1": 0.6667, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.7143, "fpr": 0.75, "youden_j": -0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 19.0, "cvss_fn_weight": 27.8, "cvss_precision": 0.7896, "cvss_recall": 0.7192, "cvss_f3": 0.7257, "cvss_f3_score": 72.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-002", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 10, "fp": 2, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8427, "recall": 0.7381, "f1": 0.785, "f2": 0.7558, "f2_score": 75.6, "f3": 0.7467, "f3_score": 74.7, "tpr": 0.7381, "fpr": 0.3833, "youden_j": 0.3548, "cvss_coverage": 1.0, "cvss_tp_weight": 73.0, "cvss_fp_weight": 8.1, "cvss_fn_weight": 26.0, "cvss_precision": 0.9019, "cvss_recall": 0.737, "cvss_f3": 0.7505, "cvss_f3_score": 75.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 7, "fp": 0, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 55.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 43.6, "cvss_precision": 1.0, "cvss_recall": 0.5596, "cvss_f3": 0.5854, "cvss_f3_score": 58.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 6, "fp": 2, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4286, "f1": 0.5455, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4478, "f3_score": 44.8, "tpr": 0.4286, "fpr": 0.4, "youden_j": 0.0286, "cvss_coverage": 1.0, "cvss_tp_weight": 47.9, "cvss_fp_weight": 11.6, "cvss_fn_weight": 51.1, "cvss_precision": 0.8044, "cvss_recall": 0.4838, "cvss_f3": 0.5039, "cvss_f3_score": 50.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 8, "fp": 1, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5714, "f1": 0.6957, "f2": 0.6154, "f2_score": 61.5, "f3": 0.5926, "f3_score": 59.3, "tpr": 0.5714, "fpr": 0.25, "youden_j": 0.3214, "cvss_coverage": 1.0, "cvss_tp_weight": 59.0, "cvss_fp_weight": 5.8, "cvss_fn_weight": 40.0, "cvss_precision": 0.9102, "cvss_recall": 0.596, "cvss_f3": 0.6173, "cvss_f3_score": 61.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 7, "fp": 4, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.5, "f1": 0.56, "f2": 0.5224, "f2_score": 52.2, "f3": 0.5109, "f3_score": 51.1, "tpr": 0.5, "fpr": 0.5714, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 51.5, "cvss_fp_weight": 23.3, "cvss_fn_weight": 47.5, "cvss_precision": 0.6886, "cvss_recall": 0.5202, "cvss_f3": 0.5332, "cvss_f3_score": 53.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 9, "fp": 4, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.6429, "f1": 0.6667, "f2": 0.6522, "f2_score": 65.2, "f3": 0.6475, "f3_score": 64.7, "tpr": 0.6429, "fpr": 0.5714, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 64.3, "cvss_fp_weight": 23.3, "cvss_fn_weight": 34.7, "cvss_precision": 0.7341, "cvss_recall": 0.6495, "cvss_f3": 0.6571, "cvss_f3_score": 65.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 7, "fp": 2, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7889, "recall": 0.5238, "f1": 0.6292, "f2": 0.5614, "f2_score": 56.1, "f3": 0.5419, "f3_score": 54.2, "tpr": 0.5238, "fpr": 0.3833, "youden_j": 0.1405, "cvss_coverage": 1.0, "cvss_tp_weight": 50.6, "cvss_fp_weight": 11.6, "cvss_fn_weight": 48.4, "cvss_precision": 0.8146, "cvss_recall": 0.5111, "cvss_f3": 0.5308, "cvss_f3_score": 53.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 9, "fp": 1, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8741, "recall": 0.6429, "f1": 0.7383, "f2": 0.6775, "f2_score": 67.7, "f3": 0.6597, "f3_score": 66.0, "tpr": 0.6429, "fpr": 0.3, "youden_j": 0.3429, "cvss_coverage": 1.0, "cvss_tp_weight": 63.6, "cvss_fp_weight": 6.0, "cvss_fn_weight": 35.4, "cvss_precision": 0.9137, "cvss_recall": 0.6428, "cvss_f3": 0.6621, "cvss_f3_score": 66.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 10, "fp": 1, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9117, "recall": 0.6905, "f1": 0.7813, "f2": 0.7234, "f2_score": 72.3, "f3": 0.7064, "f3_score": 70.6, "tpr": 0.6905, "fpr": 0.2167, "youden_j": 0.4738, "cvss_coverage": 1.0, "cvss_tp_weight": 70.0, "cvss_fp_weight": 4.0, "cvss_fn_weight": 29.0, "cvss_precision": 0.9458, "cvss_recall": 0.7071, "cvss_f3": 0.7248, "cvss_f3_score": 72.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 10, "fp": 1, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.7143, "f1": 0.8, "f2": 0.7463, "f2_score": 74.6, "f3": 0.7299, "f3_score": 73.0, "tpr": 0.7143, "fpr": 0.25, "youden_j": 0.4643, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 0.5, "cvss_fn_weight": 27.8, "cvss_precision": 0.993, "cvss_recall": 0.7192, "cvss_f3": 0.7396, "cvss_f3_score": 74.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 6, "fp": 0, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4286, "f1": 0.6, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4286, "fpr": 0.0, "youden_j": 0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 46.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 52.5, "cvss_precision": 1.0, "cvss_recall": 0.4697, "cvss_f3": 0.496, "cvss_f3_score": 49.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 12, "fp": 17, "fn": 2, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4138, "recall": 0.8571, "f1": 0.5581, "f2": 0.7059, "f2_score": 70.6, "f3": 0.7742, "f3_score": 77.4, "tpr": 0.8571, "fpr": 0.8947, "youden_j": -0.0376, "cvss_coverage": 1.0, "cvss_tp_weight": 84.0, "cvss_fp_weight": 116.5, "cvss_fn_weight": 15.0, "cvss_precision": 0.419, "cvss_recall": 0.8485, "cvss_f3": 0.7696, "cvss_f3_score": 77.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-002", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-662" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "xss.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "ssti.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 11, "fp": 12, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4783, "recall": 0.7857, "f1": 0.5946, "f2": 0.6962, "f2_score": 69.6, "f3": 0.7383, "f3_score": 73.8, "tpr": 0.7857, "fpr": 0.8, "youden_j": -0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 76.5, "cvss_fp_weight": 81.5, "cvss_fn_weight": 22.5, "cvss_precision": 0.4842, "cvss_recall": 0.7727, "cvss_f3": 0.7293, "cvss_f3_score": 72.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "swagger.yml", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "req.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 2, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.2857, "f1": 0.4, "f2": 0.3226, "f2_score": 32.3, "f3": 0.303, "f3_score": 30.3, "tpr": 0.2857, "fpr": 0.4, "youden_j": -0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 32.3, "cvss_fp_weight": 15.0, "cvss_fn_weight": 66.7, "cvss_precision": 0.6829, "cvss_recall": 0.3263, "cvss_f3": 0.3442, "cvss_f3_score": 34.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 14, "fp": 13, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5185, "recall": 1.0, "f1": 0.6829, "f2": 0.8434, "f2_score": 84.3, "f3": 0.915, "f3_score": 91.5, "tpr": 1.0, "fpr": 0.8667, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 89.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.5266, "cvss_recall": 1.0, "cvss_f3": 0.9175, "cvss_f3_score": 91.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-007", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "ssti.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-002", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "xss.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 13, "fp": 4, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.9286, "f1": 0.8387, "f2": 0.8904, "f2_score": 89.0, "f3": 0.9091, "f3_score": 90.9, "tpr": 0.9286, "fpr": 0.5714, "youden_j": 0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 32.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.7409, "cvss_recall": 0.9242, "cvss_f3": 0.9019, "cvss_f3_score": 90.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-007", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 7, "fp": 2, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.5, "f1": 0.6087, "f2": 0.5385, "f2_score": 53.8, "f3": 0.5185, "f3_score": 51.9, "tpr": 0.5, "fpr": 0.4, "youden_j": 0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 55.4, "cvss_fp_weight": 13.5, "cvss_fn_weight": 43.6, "cvss_precision": 0.8041, "cvss_recall": 0.5596, "cvss_f3": 0.5771, "cvss_f3_score": 57.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 14, "fp": 19, "fn": 0, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4242, "recall": 1.0, "f1": 0.5957, "f2": 0.7865, "f2_score": 78.7, "f3": 0.8805, "f3_score": 88.1, "tpr": 1.0, "fpr": 0.9048, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 124.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.443, "cvss_recall": 1.0, "cvss_f3": 0.8883, "cvss_f3_score": 88.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-014", "file": "app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "rfi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-007", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "sqli.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-013", "file": "sqli.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "ssti.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "ssti.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-002", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "xss.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "xss.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 8, "fp": 2, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8677, "recall": 0.5952, "f1": 0.6922, "f2": 0.6284, "f2_score": 62.8, "f3": 0.6111, "f3_score": 61.1, "tpr": 0.5952, "fpr": 0.2738, "youden_j": 0.3214, "cvss_coverage": 1.0, "cvss_tp_weight": 60.9, "cvss_fp_weight": 6.2, "cvss_fn_weight": 38.1, "cvss_precision": 0.9296, "cvss_recall": 0.6152, "cvss_f3": 0.6346, "cvss_f3_score": 63.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-98" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 8, "fp": 0, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5714, "f1": 0.7273, "f2": 0.625, "f2_score": 62.5, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5714, "fpr": 0.0, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 60.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 38.9, "cvss_precision": 1.0, "cvss_recall": 0.6071, "cvss_f3": 0.6319, "cvss_f3_score": 63.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-004", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 4, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.5714, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 12.6, "cvss_fn_weight": 27.8, "cvss_precision": 0.8492, "cvss_recall": 0.7192, "cvss_f3": 0.7304, "cvss_f3_score": 73.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-003", "file": "xss.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-005", "file": "lfi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-008", "file": "ssti.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-006", "file": "rfi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-011", "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-002", "file": "sqli.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "lfi.py", "cwe": "CWE-705" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] }, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 6, "fn": 10, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.2857, "f1": 0.3333, "f2": 0.303, "f2_score": 30.3, "f3": 0.2941, "f3_score": 29.4, "tpr": 0.2857, "fpr": 0.75, "youden_j": -0.4643, "cvss_coverage": 1.0, "cvss_tp_weight": 25.3, "cvss_fp_weight": 34.9, "cvss_fn_weight": 73.7, "cvss_precision": 0.42, "cvss_recall": 0.2556, "cvss_f3": 0.266, "cvss_f3_score": 26.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 1, "fn": 5, "recall": 0.1667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-010", "file": "app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "custom_db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-009", "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hhi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-012", "file": "rfi.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-api-001", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "vulnerable-api-fp-003", "file": "sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "ssti.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-006", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-008", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 99.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "http_header_injection": { "label": "HTTP Header Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulnerable-api-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-002", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-005", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-006", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-008", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-009", "file": null, "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-012", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-api-014", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-002", "file": null, "cwe": "CWE-1336" }, { "classification": "TN", "ground_truth_id": "vulnerable-api-fp-003", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-vulnerable-app-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 4, "fp": 11, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.5, "f1": 0.3478, "f2": 0.4255, "f2_score": 42.6, "f3": 0.4598, "f3_score": 46.0, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 26.3, "cvss_fp_weight": 56.8, "cvss_fn_weight": 23.3, "cvss_precision": 0.3165, "cvss_recall": 0.5302, "cvss_f3": 0.4967, "cvss_f3_score": 49.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/layout/ht-top-nav.directive.js", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-004", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-005", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 5, "fp": 16, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.625, "f1": 0.3448, "f2": 0.4717, "f2_score": 47.2, "f3": 0.5376, "f3_score": 53.8, "tpr": 0.625, "fpr": 1.0, "youden_j": -0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 30.6, "cvss_fp_weight": 87.8, "cvss_fn_weight": 19.0, "cvss_precision": 0.2584, "cvss_recall": 0.6169, "cvss_f3": 0.5418, "cvss_f3_score": 54.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-004", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 6, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5385, "recall": 0.875, "f1": 0.6667, "f2": 0.7778, "f2_score": 77.8, "f3": 0.8235, "f3_score": 82.4, "tpr": 0.875, "fpr": 1.0, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 44.2, "cvss_fp_weight": 25.8, "cvss_fn_weight": 5.4, "cvss_precision": 0.6314, "cvss_recall": 0.8911, "cvss_f3": 0.8559, "cvss_f3_score": 85.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-001", "file": "src/client/app/csrf/csrf.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 6, "fp": 10, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.75, "f1": 0.5, "f2": 0.625, "f2_score": 62.5, "f3": 0.6818, "f3_score": 68.2, "tpr": 0.75, "fpr": 1.0, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 39.4, "cvss_fp_weight": 56.3, "cvss_fn_weight": 10.2, "cvss_precision": 0.4117, "cvss_recall": 0.7944, "cvss_f3": 0.7268, "cvss_f3_score": 72.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-002", "file": "src/client/app/xss-search/xss-search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-001", "file": "src/client/app/csrf/csrf.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-005", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-008", "file": null, "cwe": "CWE-614" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 5, "fp": 12, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2941, "recall": 0.625, "f1": 0.4, "f2": 0.5102, "f2_score": 51.0, "f3": 0.5618, "f3_score": 56.2, "tpr": 0.625, "fpr": 1.0, "youden_j": -0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 30.6, "cvss_fp_weight": 51.6, "cvss_fn_weight": 19.0, "cvss_precision": 0.3723, "cvss_recall": 0.6169, "cvss_f3": 0.5789, "cvss_f3_score": 57.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/layout/ht-top-nav.directive.js", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-004", "file": null, "cwe": "CWE-1321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 8, "fp": 7, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 1.0, "f1": 0.6957, "f2": 0.8511, "f2_score": 85.1, "f3": 0.9195, "f3_score": 92.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 49.6, "cvss_fp_weight": 43.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.5333, "cvss_recall": 1.0, "cvss_f3": 0.9195, "cvss_f3_score": 92.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-001", "file": "src/client/app/csrf/csrf.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-002", "file": "src/client/app/xss-search/xss-search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/layout/ht-top-nav.directive.js", "cwe": "CWE-922" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 6, "fp": 9, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.75, "f1": 0.5217, "f2": 0.6383, "f2_score": 63.8, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.75, "fpr": 1.0, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 38.8, "cvss_fp_weight": 50.1, "cvss_fn_weight": 10.8, "cvss_precision": 0.4364, "cvss_recall": 0.7823, "cvss_f3": 0.7248, "cvss_f3_score": 72.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "attacker-app/src/server/app.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 8, "fp": 9, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 1.0, "f1": 0.64, "f2": 0.8163, "f2_score": 81.6, "f3": 0.8989, "f3_score": 89.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 49.6, "cvss_fp_weight": 50.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.4975, "cvss_recall": 1.0, "cvss_f3": 0.9083, "cvss_f3_score": 90.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-001", "file": "src/client/app/csrf/csrf.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-002", "file": "src/client/app/xss-search/xss-search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/layout/ht-top-nav.directive.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 8, "fp": 16, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 1.0, "f1": 0.5, "f2": 0.7143, "f2_score": 71.4, "f3": 0.8333, "f3_score": 83.3, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 49.6, "cvss_fp_weight": 125.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2833, "cvss_recall": 1.0, "cvss_f3": 0.7981, "cvss_f3_score": 79.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "attacker-app/src/client/app/layout/sidebar.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/csrf/csrf.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-001", "file": "src/client/app/csrf/csrf.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/layout/sidebar.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/app/xss-search/xss-search.controller.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-002", "file": "src/client/app/xss-search/xss-search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-003", "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-005", "file": "src/server/routes.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-004", "file": "src/server/routes.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-006", "file": "src/server/routes.js", "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 15, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1176, "recall": 0.25, "f1": 0.16, "f2": 0.2041, "f2_score": 20.4, "f3": 0.2247, "f3_score": 22.5, "tpr": 0.25, "fpr": 1.0, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 11.8, "cvss_fp_weight": 30.3, "cvss_fn_weight": 37.8, "cvss_precision": 0.2803, "cvss_recall": 0.2379, "cvss_f3": 0.2416, "cvss_f3_score": 24.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "attacker-app/src/client/app/csrf-attack/csrf-attack.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "attacker-app/src/client/specs.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "attacker-app/src/server/app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/specs.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-007", "file": "src/server/routes.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/routes.js", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vulnerable-app-angular-008", "file": "src/server/routes.js", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-003", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-004", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-005", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-app-angular-006", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "realvuln-vulnerable-flask-app": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 14, "fp": 11, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.6667, "f1": 0.6087, "f2": 0.6422, "f2_score": 64.2, "f3": 0.6542, "f3_score": 65.4, "tpr": 0.6667, "fpr": 0.7333, "youden_j": -0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 105.0, "cvss_fp_weight": 58.3, "cvss_fn_weight": 39.6, "cvss_precision": 0.6428, "cvss_recall": 0.7261, "cvss_f3": 0.7169, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 10, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4762, "f1": 0.4878, "f2": 0.4808, "f2_score": 48.1, "f3": 0.4785, "f3_score": 47.8, "tpr": 0.4762, "fpr": 0.7143, "youden_j": -0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 74.4, "cvss_fp_weight": 57.8, "cvss_fn_weight": 70.2, "cvss_precision": 0.5626, "cvss_recall": 0.5145, "cvss_f3": 0.519, "cvss_f3_score": 51.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7698, "recall": 0.6508, "f1": 0.7022, "f2": 0.6698, "f2_score": 67.0, "f3": 0.6601, "f3_score": 66.0, "tpr": 0.6508, "fpr": 0.5, "youden_j": 0.1508, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 19.6, "cvss_fn_weight": 42.6, "cvss_precision": 0.8398, "cvss_recall": 0.7056, "cvss_f3": 0.716, "cvss_f3_score": 71.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-017", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7272, "recall": 0.5238, "f1": 0.6004, "f2": 0.5508, "f2_score": 55.1, "f3": 0.5368, "f3_score": 53.7, "tpr": 0.5238, "fpr": 0.4788, "youden_j": 0.045, "cvss_coverage": 1.0, "cvss_tp_weight": 84.9, "cvss_fp_weight": 21.7, "cvss_fn_weight": 59.7, "cvss_precision": 0.8085, "cvss_recall": 0.5874, "cvss_f3": 0.6027, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 20, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4595, "recall": 0.8095, "f1": 0.5862, "f2": 0.7025, "f2_score": 70.2, "f3": 0.7522, "f3_score": 75.2, "tpr": 0.8095, "fpr": 0.8333, "youden_j": -0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 125.4, "cvss_fp_weight": 99.8, "cvss_fn_weight": 19.2, "cvss_precision": 0.5568, "cvss_recall": 0.8672, "cvss_f3": 0.8214, "cvss_f3_score": 82.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-017", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.4286, "f1": 0.5813, "f2": 0.4788, "f2_score": 47.9, "f3": 0.4523, "f3_score": 45.2, "tpr": 0.4286, "fpr": 0.1666, "youden_j": 0.2619, "cvss_coverage": 1.0, "cvss_tp_weight": 71.0, "cvss_fp_weight": 5.8, "cvss_fn_weight": 73.6, "cvss_precision": 0.9292, "cvss_recall": 0.491, "cvss_f3": 0.5152, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-005", "file": null, "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6971, "recall": 0.6032, "f1": 0.6452, "f2": 0.619, "f2_score": 61.9, "f3": 0.6109, "f3_score": 61.1, "tpr": 0.6032, "fpr": 0.5651, "youden_j": 0.0381, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 27.5, "cvss_fn_weight": 49.4, "cvss_precision": 0.7825, "cvss_recall": 0.6582, "cvss_f3": 0.6684, "cvss_f3_score": 66.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 13, "fp": 5, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7094, "recall": 0.6031, "f1": 0.6509, "f2": 0.6212, "f2_score": 62.1, "f3": 0.612, "f3_score": 61.2, "tpr": 0.6031, "fpr": 0.555, "youden_j": 0.0482, "cvss_coverage": 1.0, "cvss_tp_weight": 98.4, "cvss_fp_weight": 27.3, "cvss_fn_weight": 46.2, "cvss_precision": 0.7885, "cvss_recall": 0.6808, "cvss_f3": 0.6897, "cvss_f3_score": 69.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 15, "fp": 15, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5009, "recall": 0.6984, "f1": 0.5811, "f2": 0.6454, "f2_score": 64.5, "f3": 0.6707, "f3_score": 67.0, "tpr": 0.6984, "fpr": 0.783, "youden_j": -0.0846, "cvss_coverage": 1.0, "cvss_tp_weight": 111.6, "cvss_fp_weight": 72.5, "cvss_fn_weight": 33.0, "cvss_precision": 0.6074, "cvss_recall": 0.772, "cvss_f3": 0.7509, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-017", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 15, "fp": 12, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7143, "f1": 0.625, "f2": 0.6757, "f2_score": 67.6, "f3": 0.6944, "f3_score": 69.4, "tpr": 0.7143, "fpr": 0.75, "youden_j": -0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 112.6, "cvss_fp_weight": 58.8, "cvss_fn_weight": 32.0, "cvss_precision": 0.6568, "cvss_recall": 0.7787, "cvss_f3": 0.7645, "cvss_f3_score": 76.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 12, "fp": 2, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8762, "recall": 0.5714, "f1": 0.6904, "f2": 0.6136, "f2_score": 61.4, "f3": 0.5917, "f3_score": 59.2, "tpr": 0.5714, "fpr": 0.2889, "youden_j": 0.2825, "cvss_coverage": 1.0, "cvss_tp_weight": 92.4, "cvss_fp_weight": 9.7, "cvss_fn_weight": 52.2, "cvss_precision": 0.9025, "cvss_recall": 0.6393, "cvss_f3": 0.6578, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 9, "fp": 0, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4286, "f1": 0.6, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4286, "fpr": 0.0, "youden_j": 0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 74.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 70.4, "cvss_precision": 1.0, "cvss_recall": 0.5131, "cvss_f3": 0.5394, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 12, "fp": 6, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5714, "f1": 0.6154, "f2": 0.5882, "f2_score": 58.8, "f3": 0.5797, "f3_score": 58.0, "tpr": 0.5714, "fpr": 0.6, "youden_j": -0.0286, "cvss_coverage": 1.0, "cvss_tp_weight": 90.3, "cvss_fp_weight": 34.7, "cvss_fn_weight": 54.3, "cvss_precision": 0.7224, "cvss_recall": 0.6245, "cvss_f3": 0.6331, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 4, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-015", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 4, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.619, "f1": 0.6842, "f2": 0.6436, "f2_score": 64.4, "f3": 0.6311, "f3_score": 63.1, "tpr": 0.619, "fpr": 0.5, "youden_j": 0.119, "cvss_coverage": 1.0, "cvss_tp_weight": 102.3, "cvss_fp_weight": 23.1, "cvss_fn_weight": 42.3, "cvss_precision": 0.8156, "cvss_recall": 0.7075, "cvss_f3": 0.717, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 9, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5625, "recall": 0.4286, "f1": 0.4865, "f2": 0.45, "f2_score": 45.0, "f3": 0.439, "f3_score": 43.9, "tpr": 0.4286, "fpr": 0.6364, "youden_j": -0.2078, "cvss_coverage": 1.0, "cvss_tp_weight": 72.7, "cvss_fp_weight": 40.5, "cvss_fn_weight": 71.9, "cvss_precision": 0.6423, "cvss_recall": 0.5028, "cvss_f3": 0.5139, "cvss_f3_score": 51.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/zap_test.yml", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 11, "fp": 8, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.5238, "f1": 0.55, "f2": 0.534, "f2_score": 53.4, "f3": 0.5288, "f3_score": 52.9, "tpr": 0.5238, "fpr": 0.6667, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 84.4, "cvss_fp_weight": 41.0, "cvss_fn_weight": 60.2, "cvss_precision": 0.6731, "cvss_recall": 0.5837, "cvss_f3": 0.5915, "cvss_f3_score": 59.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-409" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 6, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6525, "recall": 0.5079, "f1": 0.5666, "f2": 0.5291, "f2_score": 52.9, "f3": 0.5182, "f3_score": 51.8, "tpr": 0.5079, "fpr": 0.6186, "youden_j": -0.1107, "cvss_coverage": 1.0, "cvss_tp_weight": 76.1, "cvss_fp_weight": 31.2, "cvss_fn_weight": 68.5, "cvss_precision": 0.7157, "cvss_recall": 0.5261, "cvss_f3": 0.5398, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7834, "recall": 0.6667, "f1": 0.7179, "f2": 0.6858, "f2_score": 68.6, "f3": 0.676, "f3_score": 67.6, "tpr": 0.6667, "fpr": 0.4857, "youden_j": 0.181, "cvss_coverage": 1.0, "cvss_tp_weight": 105.0, "cvss_fp_weight": 16.1, "cvss_fn_weight": 39.6, "cvss_precision": 0.8668, "cvss_recall": 0.7262, "cvss_f3": 0.7381, "cvss_f3_score": 73.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-017", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 14, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5132, "recall": 0.6825, "f1": 0.5858, "f2": 0.6402, "f2_score": 64.0, "f3": 0.6607, "f3_score": 66.1, "tpr": 0.6825, "fpr": 0.7708, "youden_j": -0.0882, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 57.9, "cvss_fn_weight": 38.6, "cvss_precision": 0.653, "cvss_recall": 0.7328, "cvss_f3": 0.7236, "cvss_f3_score": 72.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 12, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.5714, "f1": 0.6316, "f2": 0.5941, "f2_score": 59.4, "f3": 0.5825, "f3_score": 58.3, "tpr": 0.5714, "fpr": 0.5556, "youden_j": 0.0159, "cvss_coverage": 1.0, "cvss_tp_weight": 96.5, "cvss_fp_weight": 18.4, "cvss_fn_weight": 48.1, "cvss_precision": 0.8402, "cvss_recall": 0.6674, "cvss_f3": 0.6814, "cvss_f3_score": 68.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 10, "fp": 3, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.4762, "f1": 0.5882, "f2": 0.5155, "f2_score": 51.5, "f3": 0.495, "f3_score": 49.5, "tpr": 0.4762, "fpr": 0.4286, "youden_j": 0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 78.5, "cvss_fp_weight": 23.0, "cvss_fn_weight": 66.1, "cvss_precision": 0.7734, "cvss_recall": 0.5429, "cvss_f3": 0.5596, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 16, "fp": 49, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2462, "recall": 0.7619, "f1": 0.3721, "f2": 0.5369, "f2_score": 53.7, "f3": 0.6299, "f3_score": 63.0, "tpr": 0.7619, "fpr": 0.9245, "youden_j": -0.1626, "cvss_coverage": 1.0, "cvss_tp_weight": 118.8, "cvss_fp_weight": 349.5, "cvss_fn_weight": 25.8, "cvss_precision": 0.2537, "cvss_recall": 0.8216, "cvss_f3": 0.6713, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/test.db", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "github/workflows/zap_test.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "app/requirements.txt", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 17, "fp": 23, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.425, "recall": 0.8095, "f1": 0.5574, "f2": 0.6855, "f2_score": 68.5, "f3": 0.7424, "f3_score": 74.2, "tpr": 0.8095, "fpr": 0.8519, "youden_j": -0.0423, "cvss_coverage": 1.0, "cvss_tp_weight": 120.2, "cvss_fp_weight": 154.5, "cvss_fn_weight": 24.4, "cvss_precision": 0.4376, "cvss_recall": 0.8313, "cvss_f3": 0.7626, "cvss_f3_score": 76.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-015", "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-331" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-020", "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.1429, "f1": 0.25, "f2": 0.1724, "f2_score": 17.2, "f3": 0.1562, "f3_score": 15.6, "tpr": 0.1429, "fpr": 0.0, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 25.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 118.9, "cvss_precision": 1.0, "cvss_recall": 0.1777, "cvss_f3": 0.1937, "cvss_f3_score": 19.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 }, "high": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-005", "file": null, "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 20, "fp": 45, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.9524, "f1": 0.4651, "f2": 0.6711, "f2_score": 67.1, "f3": 0.7874, "f3_score": 78.7, "tpr": 0.9524, "fpr": 0.9184, "youden_j": 0.034, "cvss_coverage": 1.0, "cvss_tp_weight": 140.9, "cvss_fp_weight": 357.5, "cvss_fn_weight": 3.7, "cvss_precision": 0.2827, "cvss_recall": 0.9744, "cvss_f3": 0.7829, "cvss_f3_score": 78.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/zap_test.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/zap_test.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-015", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-020", "file": "app/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 10, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 0.9048, "f1": 0.76, "f2": 0.8407, "f2_score": 84.1, "f3": 0.8716, "f3_score": 87.2, "tpr": 0.9048, "fpr": 0.7143, "youden_j": 0.1905, "cvss_coverage": 1.0, "cvss_tp_weight": 135.0, "cvss_fp_weight": 75.0, "cvss_fn_weight": 9.6, "cvss_precision": 0.6429, "cvss_recall": 0.9336, "cvss_f3": 0.8932, "cvss_f3_score": 89.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 2, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-020", "file": "app/app.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 12, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.5714, "f1": 0.6316, "f2": 0.5941, "f2_score": 59.4, "f3": 0.5825, "f3_score": 58.3, "tpr": 0.5714, "fpr": 0.5556, "youden_j": 0.0159, "cvss_coverage": 1.0, "cvss_tp_weight": 89.1, "cvss_fp_weight": 33.0, "cvss_fn_weight": 55.5, "cvss_precision": 0.7297, "cvss_recall": 0.6162, "cvss_f3": 0.6259, "cvss_f3_score": 62.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 20, "fp": 50, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.9524, "f1": 0.4396, "f2": 0.6494, "f2_score": 64.9, "f3": 0.7722, "f3_score": 77.2, "tpr": 0.9524, "fpr": 0.9259, "youden_j": 0.0265, "cvss_coverage": 1.0, "cvss_tp_weight": 140.9, "cvss_fp_weight": 392.5, "cvss_fn_weight": 3.7, "cvss_precision": 0.2642, "cvss_recall": 0.9744, "cvss_f3": 0.7679, "cvss_f3_score": 76.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 1, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/zap_test.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/zap_test.yml", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-1104" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-015", "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-019", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-020", "file": "app/app.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/requirements.txt", "cwe": "CWE-1104" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 7, "fp": 7, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5053, "recall": 0.3175, "f1": 0.3831, "f2": 0.34, "f2_score": 34.0, "f3": 0.3283, "f3_score": 32.8, "tpr": 0.3175, "fpr": 0.6746, "youden_j": -0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 53.2, "cvss_fp_weight": 40.5, "cvss_fn_weight": 91.4, "cvss_precision": 0.5816, "cvss_recall": 0.3677, "cvss_f3": 0.3802, "cvss_f3_score": 38.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 4, "fp": 1, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": "app/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 13, "fp": 12, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.52, "recall": 0.619, "f1": 0.5652, "f2": 0.5963, "f2_score": 59.6, "f3": 0.6075, "f3_score": 60.7, "tpr": 0.619, "fpr": 0.8, "youden_j": -0.181, "cvss_coverage": 1.0, "cvss_tp_weight": 98.9, "cvss_fp_weight": 43.0, "cvss_fn_weight": 45.7, "cvss_precision": 0.697, "cvss_recall": 0.684, "cvss_f3": 0.6852, "cvss_f3_score": 68.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 }, "high": { "tp": 9, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-009", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-012", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-257" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": "app/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-016", "file": "app/app.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-005", "file": null, "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 8, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.619, "f1": 0.619, "f2": 0.619, "f2_score": 61.9, "f3": 0.619, "f3_score": 61.9, "tpr": 0.619, "fpr": 0.7273, "youden_j": -0.1082, "cvss_coverage": 1.0, "cvss_tp_weight": 97.9, "cvss_fp_weight": 41.0, "cvss_fn_weight": 46.7, "cvss_precision": 0.7049, "cvss_recall": 0.677, "cvss_f3": 0.6797, "cvss_f3_score": 68.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 1, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 3, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-008", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-006", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-011", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-010", "file": "app/app.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": "app/app.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-021", "file": "app/app.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-013", "file": "app/app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-905" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-007", "file": "app/app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 21, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.2857, "f1": 0.25, "f2": 0.2703, "f2_score": 27.0, "f3": 0.2778, "f3_score": 27.8, "tpr": 0.2857, "fpr": 0.84, "youden_j": -0.5543, "cvss_coverage": 1.0, "cvss_tp_weight": 49.2, "cvss_fp_weight": 75.5, "cvss_fn_weight": 95.4, "cvss_precision": 0.3945, "cvss_recall": 0.3402, "cvss_f3": 0.345, "cvss_f3_score": 34.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-005", "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-001", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-018", "file": "app/app.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-003", "file": "app/app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "old-workflows/semgrep.yml", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/e2e_zap.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/static/loader.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 11, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.1429, "f1": 0.1714, "f2": 0.1531, "f2_score": 15.3, "f3": 0.1478, "f3_score": 14.8, "tpr": 0.1429, "fpr": 0.7333, "youden_j": -0.5905, "cvss_coverage": 1.0, "cvss_tp_weight": 23.0, "cvss_fp_weight": 63.6, "cvss_fn_weight": 121.6, "cvss_precision": 0.2655, "cvss_recall": 0.1591, "cvss_f3": 0.1657, "cvss_f3_score": 16.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-96" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-014", "file": "app/app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-002", "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-96" }, { "classification": "FP", "ground_truth_id": null, "file": "app/app.py", "cwe": "CWE-96" }, { "classification": "TP", "ground_truth_id": "vulnerable-flask-app-004", "file": "app/app.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-005", "file": null, "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-001", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-003", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-005", "file": null, "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-012", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-014", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-015", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-016", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-020", "file": null, "cwe": "CWE-338" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnerable-flask-app-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-flask-app-021", "file": null, "cwe": "CWE-209" } ] } }, "realvuln-vulnerable-node": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 11, "fp": 7, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.5238, "f1": 0.5641, "f2": 0.5392, "f2_score": 53.9, "f3": 0.5314, "f3_score": 53.1, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 77.2, "cvss_fp_weight": 29.5, "cvss_fn_weight": 69.7, "cvss_precision": 0.7237, "cvss_recall": 0.5255, "cvss_f3": 0.5403, "cvss_f3_score": 54.0, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 8, "recall": 0.5789 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-013", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 4, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.5238, "f1": 0.6111, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5392, "f3_score": 53.9, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 80.9, "cvss_fp_weight": 15.0, "cvss_fn_weight": 66.0, "cvss_precision": 0.8437, "cvss_recall": 0.5507, "cvss_f3": 0.5705, "cvss_f3_score": 57.1, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 8, "recall": 0.5789 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-006", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dummy.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-013", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-018", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 5, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.619, "f1": 0.6667, "f2": 0.6373, "f2_score": 63.7, "f3": 0.628, "f3_score": 62.8, "tpr": 0.619, "fpr": 1.0, "youden_j": -0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 90.5, "cvss_fp_weight": 22.0, "cvss_fn_weight": 56.4, "cvss_precision": 0.8045, "cvss_recall": 0.6161, "cvss_f3": 0.6308, "cvss_f3_score": 63.1, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-016", "file": "routes/products.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-006", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-018", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 13, "fp": 6, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.619, "f1": 0.65, "f2": 0.6311, "f2_score": 63.1, "f3": 0.625, "f3_score": 62.5, "tpr": 0.619, "fpr": 1.0, "youden_j": -0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 35.5, "cvss_fn_weight": 56.3, "cvss_precision": 0.7186, "cvss_recall": 0.6167, "cvss_f3": 0.6256, "cvss_f3_score": 62.6, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-012", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-547" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 15, "fp": 13, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.7143, "f1": 0.6122, "f2": 0.6696, "f2_score": 67.0, "f3": 0.6912, "f3_score": 69.1, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 105.0, "cvss_fp_weight": 71.5, "cvss_fn_weight": 41.9, "cvss_precision": 0.5951, "cvss_recall": 0.7148, "cvss_f3": 0.7007, "cvss_f3_score": 70.1, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 4, "recall": 0.7895 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-016", "file": "routes/products.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-547" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-006", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-007", "file": "dummy.js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "model/init_db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 13, "fp": 16, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4483, "recall": 0.619, "f1": 0.52, "f2": 0.5752, "f2_score": 57.5, "f3": 0.5963, "f3_score": 59.6, "tpr": 0.619, "fpr": 1.0, "youden_j": -0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 98.9, "cvss_fn_weight": 56.3, "cvss_precision": 0.478, "cvss_recall": 0.6167, "cvss_f3": 0.5994, "cvss_f3_score": 59.9, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "model/auth.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "model/init_db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 15, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7143, "f1": 0.5882, "f2": 0.6579, "f2_score": 65.8, "f3": 0.6849, "f3_score": 68.5, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 104.0, "cvss_fp_weight": 98.4, "cvss_fn_weight": 42.9, "cvss_precision": 0.5137, "cvss_recall": 0.708, "cvss_f3": 0.6822, "cvss_f3_score": 68.2, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 5, "recall": 0.7368 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-015", "file": "routes/login.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "model/init_db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-006", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-005", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 11, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6452, "recall": 0.9524, "f1": 0.7692, "f2": 0.8696, "f2_score": 87.0, "f3": 0.9091, "f3_score": 90.9, "tpr": 0.9524, "fpr": 1.0, "youden_j": -0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 137.8, "cvss_fp_weight": 64.0, "cvss_fn_weight": 9.1, "cvss_precision": 0.683, "cvss_recall": 0.9381, "cvss_f3": 0.9043, "cvss_f3_score": 90.4, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 1, "recall": 0.9474 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-003", "file": "app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-005", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-006", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-007", "file": "dummy.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "model/init_db.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-015", "file": "routes/login.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-472" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-016", "file": "routes/products.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-017", "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 19, "fp": 18, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5135, "recall": 0.9048, "f1": 0.6552, "f2": 0.7851, "f2_score": 78.5, "f3": 0.8407, "f3_score": 84.1, "tpr": 0.9048, "fpr": 1.0, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 128.7, "cvss_fp_weight": 134.0, "cvss_fn_weight": 18.2, "cvss_precision": 0.4899, "cvss_recall": 0.8761, "cvss_f3": 0.8121, "cvss_f3_score": 81.2, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-node-003", "file": "app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "model/auth.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-008", "file": "model/auth.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-009", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-010", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-011", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-012", "file": "model/products.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-013", "file": "routes/login.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-015", "file": "routes/login.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login_check.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-017", "file": "routes/products.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/error.ejs", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-016", "file": "routes/products.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-001", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-004", "file": "config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-005", "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/products.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 41, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1087, "recall": 0.2381, "f1": 0.1493, "f2": 0.1923, "f2_score": 19.2, "f3": 0.2128, "f3_score": 21.3, "tpr": 0.2381, "fpr": 1.0, "youden_j": -0.7619, "cvss_coverage": 1.0, "cvss_tp_weight": 25.1, "cvss_fp_weight": 280.3, "cvss_fn_weight": 121.8, "cvss_precision": 0.0822, "cvss_recall": 0.1709, "cvss_f3": 0.1542, "cvss_f3_score": 15.4, "per_family": { "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/jquery.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/js/jquery.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-014", "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/login.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-018", "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/bought_products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/content.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-019", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-020", "file": "views/login.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/product_detail.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/products.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-node-021", "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/search.ejs", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-011", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-013", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-015", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-node-017", "file": null, "cwe": "CWE-352" } ] }, "sonarqube": null }, "realvuln-vulnerable-nodejs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 6, "fp": 7, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.3158, "f1": 0.375, "f2": 0.3371, "f2_score": 33.7, "f3": 0.3261, "f3_score": 32.6, "tpr": 0.3158, "fpr": 1.0, "youden_j": -0.6842, "cvss_coverage": 1.0, "cvss_tp_weight": 44.8, "cvss_fp_weight": 41.3, "cvss_fn_weight": 84.4, "cvss_precision": 0.5203, "cvss_recall": 0.3467, "cvss_f3": 0.3587, "cvss_f3_score": 35.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/php.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-006", "file": "execphp.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-017", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 11, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3529, "recall": 0.3158, "f1": 0.3333, "f2": 0.3226, "f2_score": 32.3, "f3": 0.3191, "f3_score": 31.9, "tpr": 0.3158, "fpr": 1.0, "youden_j": -0.6842, "cvss_coverage": 1.0, "cvss_tp_weight": 45.3, "cvss_fp_weight": 55.9, "cvss_fn_weight": 83.9, "cvss_precision": 0.4476, "cvss_recall": 0.3506, "cvss_f3": 0.3584, "cvss_f3_score": 35.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/php.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 13, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.35, "recall": 0.3684, "f1": 0.359, "f2": 0.3646, "f2_score": 36.5, "f3": 0.3665, "f3_score": 36.6, "tpr": 0.3684, "fpr": 1.0, "youden_j": -0.6316, "cvss_coverage": 1.0, "cvss_tp_weight": 54.0, "cvss_fp_weight": 82.1, "cvss_fn_weight": 75.2, "cvss_precision": 0.3968, "cvss_recall": 0.418, "cvss_f3": 0.4157, "cvss_f3_score": 41.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/php.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/php.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/order.php", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-013", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 5, "fp": 8, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3846, "recall": 0.2632, "f1": 0.3125, "f2": 0.2809, "f2_score": 28.1, "f3": 0.2717, "f3_score": 27.2, "tpr": 0.2632, "fpr": 1.0, "youden_j": -0.7368, "cvss_coverage": 1.0, "cvss_tp_weight": 40.0, "cvss_fp_weight": 41.8, "cvss_fn_weight": 89.2, "cvss_precision": 0.489, "cvss_recall": 0.3096, "cvss_f3": 0.3214, "cvss_f3_score": 32.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-006", "file": "execphp.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/admin.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/order.php", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-007", "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "views/login.jade", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 9, "fp": 16, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 0.4737, "f1": 0.4091, "f2": 0.4455, "f2_score": 44.6, "f3": 0.4592, "f3_score": 45.9, "tpr": 0.4737, "fpr": 1.0, "youden_j": -0.5263, "cvss_coverage": 1.0, "cvss_tp_weight": 67.3, "cvss_fp_weight": 83.6, "cvss_fn_weight": 61.9, "cvss_precision": 0.446, "cvss_recall": 0.5209, "cvss_f3": 0.5123, "cvss_f3_score": 51.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-006", "file": "execphp.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-018", "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/order.php", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-007", "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "views/error.jade", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 12, "fp": 14, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.6316, "f1": 0.5333, "f2": 0.5882, "f2_score": 58.8, "f3": 0.6091, "f3_score": 60.9, "tpr": 0.6316, "fpr": 1.0, "youden_j": -0.3684, "cvss_coverage": 1.0, "cvss_tp_weight": 83.8, "cvss_fp_weight": 88.9, "cvss_fn_weight": 45.4, "cvss_precision": 0.4852, "cvss_recall": 0.6486, "cvss_f3": 0.6275, "cvss_f3_score": 62.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 }, "low": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/javascripts/global.js", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-012", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-014", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-017", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-019", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "execphp.js", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/order.php", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-007", "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "views/error.jade", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.jade", "cwe": "CWE-494" }, { "classification": "FP", "ground_truth_id": null, "file": "views/login.jade", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 11, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5789, "f1": 0.5366, "f2": 0.5612, "f2_score": 56.1, "f3": 0.5699, "f3_score": 57.0, "tpr": 0.5789, "fpr": 1.0, "youden_j": -0.4211, "cvss_coverage": 1.0, "cvss_tp_weight": 84.6, "cvss_fp_weight": 68.5, "cvss_fn_weight": 44.6, "cvss_precision": 0.5526, "cvss_recall": 0.6548, "cvss_f3": 0.6429, "cvss_f3_score": 64.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-006", "file": "execphp.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-013", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-018", "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "public/javascripts/global.js", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "phpFiles/order.php", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-007", "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.jade", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "views/login.jade", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 10, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 1.0, "f1": 0.7917, "f2": 0.9048, "f2_score": 90.5, "f3": 0.95, "f3_score": 95.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 129.2, "cvss_fp_weight": 61.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.6768, "cvss_recall": 1.0, "cvss_f3": 0.9544, "cvss_f3_score": 95.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-004", "file": "app.js", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-006", "file": "execphp.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-009", "file": "routes/php.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/layout.jade", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/admin.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-012", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-013", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-014", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-015", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-017", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-018", "file": "routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-019", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-007", "file": "phpFiles/test.php", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "public/javascripts/global.js", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "views/login.jade", "cwe": "CWE-549" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 16, "fp": 10, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.8421, "f1": 0.7111, "f2": 0.7843, "f2_score": 78.4, "f3": 0.8122, "f3_score": 81.2, "tpr": 0.8421, "fpr": 1.0, "youden_j": -0.1579, "cvss_coverage": 1.0, "cvss_tp_weight": 107.7, "cvss_fp_weight": 70.0, "cvss_fn_weight": 21.5, "cvss_precision": 0.6061, "cvss_recall": 0.8336, "cvss_f3": 0.8034, "cvss_f3_score": 80.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 }, "low": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-003", "file": "app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-004", "file": "app.js", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-005", "file": "execphp.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-008", "file": "public/javascripts/global.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-009", "file": "routes/php.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-012", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-014", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-015", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-017", "file": "routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-019", "file": "routes/users.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "views/error.jade", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-001", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-016", "file": "routes/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-002", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-010", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-011", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-nodejs-013", "file": "routes/users.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 8, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 48.1, "cvss_fn_weight": 129.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-003", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-005", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-007", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-010", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-016", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-017", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-nodejs-019", "file": null, "cwe": "CWE-209" } ] }, "sonarqube": null }, "realvuln-vulnerable-python-apps": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 14, "fp": 11, "fn": 8, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.6364, "f1": 0.5957, "f2": 0.6195, "f2_score": 61.9, "f3": 0.6278, "f3_score": 62.8, "tpr": 0.6364, "fpr": 0.6875, "youden_j": -0.0511, "cvss_coverage": 1.0, "cvss_tp_weight": 97.6, "cvss_fp_weight": 62.6, "cvss_fn_weight": 56.1, "cvss_precision": 0.6092, "cvss_recall": 0.635, "cvss_f3": 0.6323, "cvss_f3_score": 63.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-018", "file": "SQLI/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 1, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.4545, "f1": 0.6061, "f2": 0.5051, "f2_score": 50.5, "f3": 0.4785, "f3_score": 47.8, "tpr": 0.4545, "fpr": 0.1667, "youden_j": 0.2879, "cvss_coverage": 1.0, "cvss_tp_weight": 74.2, "cvss_fp_weight": 5.7, "cvss_fn_weight": 79.5, "cvss_precision": 0.9287, "cvss_recall": 0.4828, "cvss_f3": 0.5071, "cvss_f3_score": 50.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-019", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 8, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5684, "recall": 0.4545, "f1": 0.5009, "f2": 0.4713, "f2_score": 47.1, "f3": 0.4627, "f3_score": 46.2, "tpr": 0.4545, "fpr": 0.5985, "youden_j": -0.1439, "cvss_coverage": 1.0, "cvss_tp_weight": 70.6, "cvss_fp_weight": 33.3, "cvss_fn_weight": 83.1, "cvss_precision": 0.6976, "cvss_recall": 0.4591, "cvss_f3": 0.4728, "cvss_f3_score": 47.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-019", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-354" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-354" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "RCE/sentry_rce.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "RCE/sentry_rce.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-016", "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 2, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.813, "recall": 0.3788, "f1": 0.5152, "f2": 0.4235, "f2_score": 42.3, "f3": 0.3999, "f3_score": 40.0, "tpr": 0.3788, "fpr": 0.2758, "youden_j": 0.103, "cvss_coverage": 1.0, "cvss_tp_weight": 58.3, "cvss_fp_weight": 11.4, "cvss_fn_weight": 95.4, "cvss_precision": 0.8419, "cvss_recall": 0.3791, "cvss_f3": 0.4009, "cvss_f3_score": 40.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 10, "fp": 8, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.4545, "f1": 0.5, "f2": 0.4717, "f2_score": 47.2, "f3": 0.463, "f3_score": 46.3, "tpr": 0.4545, "fpr": 0.6154, "youden_j": -0.1608, "cvss_coverage": 1.0, "cvss_tp_weight": 72.8, "cvss_fp_weight": 30.0, "cvss_fn_weight": 80.9, "cvss_precision": 0.7084, "cvss_recall": 0.4736, "cvss_f3": 0.4899, "cvss_f3_score": 49.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-006", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/running_flask.txt", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-354" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 8, "fp": 0, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.9445, "recall": 0.3863, "f1": 0.5484, "f2": 0.4381, "f2_score": 43.8, "f3": 0.4107, "f3_score": 41.0, "tpr": 0.3863, "fpr": 0.0833, "youden_j": 0.3031, "cvss_coverage": 1.0, "cvss_tp_weight": 62.1, "cvss_fp_weight": 2.9, "cvss_fn_weight": 91.6, "cvss_precision": 0.9546, "cvss_recall": 0.4041, "cvss_f3": 0.4287, "cvss_f3_score": 42.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 2, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.3182, "f1": 0.4516, "f2": 0.3608, "f2_score": 36.1, "f3": 0.3382, "f3_score": 33.8, "tpr": 0.3182, "fpr": 0.2857, "youden_j": 0.0325, "cvss_coverage": 1.0, "cvss_tp_weight": 52.2, "cvss_fp_weight": 11.4, "cvss_fn_weight": 101.5, "cvss_precision": 0.8209, "cvss_recall": 0.3396, "cvss_f3": 0.3608, "cvss_f3_score": 36.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 9, "fp": 4, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7281, "recall": 0.4242, "f1": 0.5251, "f2": 0.4582, "f2_score": 45.8, "f3": 0.4404, "f3_score": 44.0, "tpr": 0.4242, "fpr": 0.3949, "youden_j": 0.0294, "cvss_coverage": 1.0, "cvss_tp_weight": 61.8, "cvss_fp_weight": 17.8, "cvss_fn_weight": 91.9, "cvss_precision": 0.7939, "cvss_recall": 0.4021, "cvss_f3": 0.4222, "cvss_f3_score": 42.2, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 14, "fp": 5, "fn": 8, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7569, "recall": 0.6364, "f1": 0.6871, "f2": 0.6548, "f2_score": 65.5, "f3": 0.6453, "f3_score": 64.5, "tpr": 0.6364, "fpr": 0.4159, "youden_j": 0.2205, "cvss_coverage": 1.0, "cvss_tp_weight": 102.2, "cvss_fp_weight": 25.2, "cvss_fn_weight": 51.5, "cvss_precision": 0.8141, "cvss_recall": 0.6651, "cvss_f3": 0.6772, "cvss_f3_score": 67.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-006", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-007", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-008", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 11, "fp": 2, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8281, "recall": 0.5152, "f1": 0.6246, "f2": 0.5528, "f2_score": 55.3, "f3": 0.5332, "f3_score": 53.3, "tpr": 0.5152, "fpr": 0.2989, "youden_j": 0.2162, "cvss_coverage": 1.0, "cvss_tp_weight": 83.9, "cvss_fp_weight": 13.3, "cvss_fn_weight": 69.8, "cvss_precision": 0.8623, "cvss_recall": 0.5456, "cvss_f3": 0.5643, "cvss_f3_score": 56.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-006", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-007", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 8, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.5909, "f1": 0.6047, "f2": 0.5963, "f2_score": 59.6, "f3": 0.5936, "f3_score": 59.4, "tpr": 0.5909, "fpr": 0.6154, "youden_j": -0.0245, "cvss_coverage": 1.0, "cvss_tp_weight": 96.4, "cvss_fp_weight": 30.0, "cvss_fn_weight": 57.3, "cvss_precision": 0.7629, "cvss_recall": 0.6272, "cvss_f3": 0.6386, "cvss_f3_score": 63.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-016", "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "RCE/sentry_rce.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "SSRF/sentry_rce.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 11, "fp": 0, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6634, "f2": 0.5544, "f2_score": 55.5, "f3": 0.5257, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 78.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 75.4, "cvss_precision": 1.0, "cvss_recall": 0.5092, "cvss_f3": 0.5348, "cvss_f3_score": 53.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 6, "fp": 1, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.2727, "f1": 0.4138, "f2": 0.3158, "f2_score": 31.6, "f3": 0.2927, "f3_score": 29.3, "tpr": 0.2727, "fpr": 0.1667, "youden_j": 0.1061, "cvss_coverage": 1.0, "cvss_tp_weight": 39.6, "cvss_fp_weight": 5.7, "cvss_fn_weight": 114.1, "cvss_precision": 0.8743, "cvss_recall": 0.2576, "cvss_f3": 0.2772, "cvss_f3_score": 27.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-018", "file": "SQLI/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 7, "fp": 10, "fn": 15, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4118, "recall": 0.3182, "f1": 0.359, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3256, "f3_score": 32.6, "tpr": 0.3182, "fpr": 0.6667, "youden_j": -0.3485, "cvss_coverage": 1.0, "cvss_tp_weight": 49.4, "cvss_fp_weight": 46.5, "cvss_fn_weight": 104.3, "cvss_precision": 0.5149, "cvss_recall": 0.3214, "cvss_f3": 0.334, "cvss_f3_score": 33.4, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 4, "fp": 4, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.1818, "f1": 0.2667, "f2": 0.2083, "f2_score": 20.8, "f3": 0.1942, "f3_score": 19.4, "tpr": 0.1818, "fpr": 0.4444, "youden_j": -0.2626, "cvss_coverage": 1.0, "cvss_tp_weight": 28.3, "cvss_fp_weight": 22.8, "cvss_fn_weight": 125.4, "cvss_precision": 0.5541, "cvss_recall": 0.1841, "cvss_f3": 0.1973, "cvss_f3_score": 19.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-354" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 4, "fp": 8, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.1818, "f1": 0.2353, "f2": 0.2, "f2_score": 20.0, "f3": 0.1905, "f3_score": 19.0, "tpr": 0.1818, "fpr": 0.6154, "youden_j": -0.4336, "cvss_coverage": 1.0, "cvss_tp_weight": 28.3, "cvss_fp_weight": 35.2, "cvss_fn_weight": 125.4, "cvss_precision": 0.446, "cvss_recall": 0.1841, "cvss_f3": 0.1956, "cvss_f3_score": 19.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 6, "fp": 8, "fn": 16, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.2727, "f1": 0.3333, "f2": 0.2941, "f2_score": 29.4, "f3": 0.283, "f3_score": 28.3, "tpr": 0.2727, "fpr": 0.6154, "youden_j": -0.3427, "cvss_coverage": 1.0, "cvss_tp_weight": 43.3, "cvss_fp_weight": 35.2, "cvss_fn_weight": 110.4, "cvss_precision": 0.5519, "cvss_recall": 0.2817, "cvss_f3": 0.2962, "cvss_f3_score": 29.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 6, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6434, "recall": 0.4848, "f1": 0.5528, "f2": 0.5099, "f2_score": 51.0, "f3": 0.4971, "f3_score": 49.7, "tpr": 0.4848, "fpr": 0.5246, "youden_j": -0.0397, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 25.5, "cvss_fn_weight": 81.9, "cvss_precision": 0.733, "cvss_recall": 0.4674, "cvss_f3": 0.4848, "cvss_f3_score": 48.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-696" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-696" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 9, "fp": 3, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.7625, "recall": 0.4091, "f1": 0.5263, "f2": 0.4484, "f2_score": 44.8, "f3": 0.4277, "f3_score": 42.8, "tpr": 0.4091, "fpr": 0.3472, "youden_j": 0.0619, "cvss_coverage": 1.0, "cvss_tp_weight": 59.6, "cvss_fp_weight": 8.4, "cvss_fn_weight": 94.1, "cvss_precision": 0.8783, "cvss_recall": 0.3878, "cvss_f3": 0.4098, "cvss_f3_score": 41.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 10, "fp": 5, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6846, "recall": 0.4394, "f1": 0.5201, "f2": 0.467, "f2_score": 46.7, "f3": 0.4526, "f3_score": 45.2, "tpr": 0.4394, "fpr": 0.4345, "youden_j": 0.0049, "cvss_coverage": 1.0, "cvss_tp_weight": 66.8, "cvss_fp_weight": 7.5, "cvss_fn_weight": 86.9, "cvss_precision": 0.9012, "cvss_recall": 0.4344, "cvss_f3": 0.4547, "cvss_f3_score": 45.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 12, "fp": 3, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5455, "f1": 0.6486, "f2": 0.5825, "f2_score": 58.3, "f3": 0.5634, "f3_score": 56.3, "tpr": 0.5455, "fpr": 0.375, "youden_j": 0.1705, "cvss_coverage": 1.0, "cvss_tp_weight": 83.9, "cvss_fp_weight": 17.1, "cvss_fn_weight": 69.8, "cvss_precision": 0.8309, "cvss_recall": 0.5459, "cvss_f3": 0.5653, "cvss_f3_score": 56.5, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-006", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-007", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-008", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 8, "fp": 9, "fn": 14, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 0.3636, "f1": 0.4103, "f2": 0.381, "f2_score": 38.1, "f3": 0.3721, "f3_score": 37.2, "tpr": 0.3636, "fpr": 0.6429, "youden_j": -0.2792, "cvss_coverage": 1.0, "cvss_tp_weight": 59.4, "cvss_fp_weight": 52.0, "cvss_fn_weight": 94.3, "cvss_precision": 0.5332, "cvss_recall": 0.3865, "cvss_f3": 0.3974, "cvss_f3_score": 39.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-016", "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 10, "fp": 48, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.1724, "recall": 0.4545, "f1": 0.25, "f2": 0.3425, "f2_score": 34.2, "f3": 0.3906, "f3_score": 39.1, "tpr": 0.4545, "fpr": 0.9057, "youden_j": -0.4511, "cvss_coverage": 1.0, "cvss_tp_weight": 66.3, "cvss_fp_weight": 294.5, "cvss_fn_weight": 87.4, "cvss_precision": 0.1838, "cvss_recall": 0.4314, "cvss_f3": 0.3801, "cvss_f3_score": 38.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-325" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-325" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-018", "file": "SQLI/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 11, "fp": 29, "fn": 11, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.275, "recall": 0.5, "f1": 0.3548, "f2": 0.4297, "f2_score": 43.0, "f3": 0.4622, "f3_score": 46.2, "tpr": 0.5, "fpr": 0.8529, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 70.8, "cvss_fp_weight": 187.5, "cvss_fn_weight": 82.9, "cvss_precision": 0.2741, "cvss_recall": 0.4606, "cvss_f3": 0.4313, "cvss_f3_score": 43.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-015", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-835" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-754" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-404" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 3, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.1818, "f1": 0.2759, "f2": 0.2105, "f2_score": 21.1, "f3": 0.1951, "f3_score": 19.5, "tpr": 0.1818, "fpr": 0.375, "youden_j": -0.1932, "cvss_coverage": 1.0, "cvss_tp_weight": 28.6, "cvss_fp_weight": 27.0, "cvss_fn_weight": 125.1, "cvss_precision": 0.5144, "cvss_recall": 0.1861, "cvss_f3": 0.1988, "cvss_f3_score": 19.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 13, "fp": 24, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.3514, "recall": 0.5909, "f1": 0.4407, "f2": 0.52, "f2_score": 52.0, "f3": 0.5532, "f3_score": 55.3, "tpr": 0.5909, "fpr": 0.8276, "youden_j": -0.2367, "cvss_coverage": 1.0, "cvss_tp_weight": 91.7, "cvss_fp_weight": 189.5, "cvss_fn_weight": 62.0, "cvss_precision": 0.3261, "cvss_recall": 0.5966, "cvss_f3": 0.5509, "cvss_f3_score": 55.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-183" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-018", "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 17, "fp": 10, "fn": 5, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6296, "recall": 0.7727, "f1": 0.6939, "f2": 0.7391, "f2_score": 73.9, "f3": 0.7556, "f3_score": 75.6, "tpr": 0.7727, "fpr": 0.6667, "youden_j": 0.1061, "cvss_coverage": 1.0, "cvss_tp_weight": 114.8, "cvss_fp_weight": 77.5, "cvss_fn_weight": 38.9, "cvss_precision": 0.597, "cvss_recall": 0.7469, "cvss_f3": 0.7286, "cvss_f3_score": 72.9, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-020", "file": "Other/length_extension_attack.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-022", "file": "Other/vuln_payment_code.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-015", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-006", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-007", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-008", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 6, "fn": 13, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.4091, "f1": 0.4865, "f2": 0.4369, "f2_score": 43.7, "f3": 0.4225, "f3_score": 42.3, "tpr": 0.4091, "fpr": 0.5455, "youden_j": -0.1364, "cvss_coverage": 1.0, "cvss_tp_weight": 62.8, "cvss_fp_weight": 28.5, "cvss_fn_weight": 90.9, "cvss_precision": 0.6878, "cvss_recall": 0.4086, "cvss_f3": 0.4259, "cvss_f3_score": 42.6, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-019", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-021", "file": "Other/vuln_payment_code.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 13, "fp": 32, "fn": 9, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2889, "recall": 0.5909, "f1": 0.3881, "f2": 0.4887, "f2_score": 48.9, "f3": 0.535, "f3_score": 53.5, "tpr": 0.5909, "fpr": 0.8649, "youden_j": -0.274, "cvss_coverage": 1.0, "cvss_tp_weight": 91.7, "cvss_fp_weight": 233.5, "cvss_fn_weight": 62.0, "cvss_precision": 0.282, "cvss_recall": 0.5966, "cvss_f3": 0.5367, "cvss_f3_score": 53.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-183" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-018", "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 6, "fn": 12, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6072, "recall": 0.4546, "f1": 0.5051, "f2": 0.4716, "f2_score": 47.1, "f3": 0.4627, "f3_score": 46.2, "tpr": 0.4546, "fpr": 0.5228, "youden_j": -0.0682, "cvss_coverage": 1.0, "cvss_tp_weight": 73.8, "cvss_fp_weight": 31.4, "cvss_fn_weight": 79.9, "cvss_precision": 0.6684, "cvss_recall": 0.4798, "cvss_f3": 0.4898, "cvss_f3_score": 49.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/length_extension_attack.py", "cwe": "CWE-324" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/vuln_payment_code.py", "cwe": "CWE-324" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 22, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 153.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-011", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 8, "fn": 10, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.5455, "f1": 0.5714, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5505, "f3_score": 55.0, "tpr": 0.5455, "fpr": 0.6154, "youden_j": -0.0699, "cvss_coverage": 1.0, "cvss_tp_weight": 88.9, "cvss_fp_weight": 40.3, "cvss_fn_weight": 64.8, "cvss_precision": 0.6878, "cvss_recall": 0.5784, "cvss_f3": 0.5877, "cvss_f3_score": 58.8, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/db.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-010", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-017", "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-009", "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-012", "file": "Other/length_extension_attack.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-013", "file": "Other/vuln_payment_code.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-003", "file": "SQLI/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-016", "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "SSRF/sentry_rce.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/serialize_server.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-320" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-644" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 3, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2727, "recall": 0.1364, "f1": 0.1818, "f2": 0.1515, "f2_score": 15.2, "f3": 0.1435, "f3_score": 14.4, "tpr": 0.1364, "fpr": 0.6667, "youden_j": -0.5303, "cvss_coverage": 1.0, "cvss_tp_weight": 22.5, "cvss_fp_weight": 30.5, "cvss_fn_weight": 131.2, "cvss_precision": 0.4245, "cvss_recall": 0.1464, "cvss_f3": 0.1567, "cvss_f3_score": 15.7, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 1, "fn": 3, "precision": 0.6667, "recall": 0.4 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 1, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-002", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-005", "file": "SQLI/sqli_example.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 10, "fn": 20, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.0909, "f1": 0.1176, "f2": 0.1, "f2_score": 10.0, "f3": 0.0952, "f3_score": 9.5, "tpr": 0.0909, "fpr": 0.6667, "youden_j": -0.5758, "cvss_coverage": 1.0, "cvss_tp_weight": 17.5, "cvss_fp_weight": 46.5, "cvss_fn_weight": 136.2, "cvss_precision": 0.2733, "cvss_recall": 0.1139, "cvss_f3": 0.1209, "cvss_f3_score": 12.1, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-016", "file": "Insecure_Deserialization/exploitApickle.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "RCE/sentry_rce.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "RCE/sentry_rce.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/templates/create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/templates/edit.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/templates/edit.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "SSRF/sentry_rce.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "SSRF/sentry_rce.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "XSS/templates/index.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-014", "file": null, "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 6, "fn": 18, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.1818, "f1": 0.25, "f2": 0.2041, "f2_score": 20.4, "f3": 0.1923, "f3_score": 19.2, "tpr": 0.1818, "fpr": 0.5455, "youden_j": -0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 28.3, "cvss_fp_weight": 52.5, "cvss_fn_weight": 125.4, "cvss_precision": 0.3502, "cvss_recall": 0.1841, "cvss_f3": 0.1933, "cvss_f3_score": 19.3, "per_family": { "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-001", "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Directory_Traversal/Dir_Traversal.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "Insecure_Frameworks/bad_mvc.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-014", "file": "Other/host_header_injection.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/host_header_injection.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-011", "file": "Other/url_fetch.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "Other/url_fetch.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-python-apps-004", "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "SQLI/main_safe.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-006", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-009", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-010", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-012", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-013", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-018", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-019", "file": null, "cwe": "CWE-354" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-python-apps-022", "file": null, "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-004", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-python-apps-fp-005", "file": null, "cwe": "CWE-89" } ] } }, "realvuln-vulnerable-react-fatih": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 1, "fp": 20, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0476, "recall": 0.1429, "f1": 0.0714, "f2": 0.102, "f2_score": 10.2, "f3": 0.119, "f3_score": 11.9, "tpr": 0.1429, "fpr": 1.0, "youden_j": -0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 118.1, "cvss_fn_weight": 38.9, "cvss_precision": 0.0716, "cvss_recall": 0.1896, "cvss_f3": 0.1627, "cvss_f3_score": 16.3, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/ProtoPollution.jsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/JwtTampering.jsx", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 2, "fp": 17, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1053, "recall": 0.2857, "f1": 0.1538, "f2": 0.2128, "f2_score": 21.3, "f3": 0.2439, "f3_score": 24.4, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 13.4, "cvss_fp_weight": 116.6, "cvss_fn_weight": 34.6, "cvss_precision": 0.1031, "cvss_recall": 0.2792, "cvss_f3": 0.2384, "cvss_f3_score": 23.8, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/ProtoPollution.jsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 2, "fp": 21, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.087, "recall": 0.2857, "f1": 0.1333, "f2": 0.1961, "f2_score": 19.6, "f3": 0.2326, "f3_score": 23.3, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 13.4, "cvss_fp_weight": 112.2, "cvss_fn_weight": 34.6, "cvss_precision": 0.1067, "cvss_recall": 0.2792, "cvss_f3": 0.2403, "cvss_f3_score": 24.0, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/ProtoPollution.jsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 2, "fp": 21, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.087, "recall": 0.2857, "f1": 0.1333, "f2": 0.1961, "f2_score": 19.6, "f3": 0.2326, "f3_score": 23.3, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 13.4, "cvss_fp_weight": 137.6, "cvss_fn_weight": 34.6, "cvss_precision": 0.0887, "cvss_recall": 0.2792, "cvss_f3": 0.2298, "cvss_f3_score": 23.0, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/ProtoPollution.jsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/PrivateRoute.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/JwtTampering.jsx", "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 2, "fp": 32, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0588, "recall": 0.2857, "f1": 0.0976, "f2": 0.1613, "f2_score": 16.1, "f3": 0.2062, "f3_score": 20.6, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 13.4, "cvss_fp_weight": 181.3, "cvss_fn_weight": 34.6, "cvss_precision": 0.0688, "cvss_recall": 0.2792, "cvss_f3": 0.2138, "cvss_f3_score": 21.4, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/JwtTampering.jsx", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/ProtoPollution.jsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Register.jsx", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 4, "fp": 14, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.5714, "f1": 0.32, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 27.8, "cvss_fp_weight": 83.3, "cvss_fn_weight": 20.2, "cvss_precision": 0.2503, "cvss_recall": 0.5792, "cvss_f3": 0.5119, "cvss_f3_score": 51.2, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-001", "file": "backend/server.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-003", "file": "backend/server.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 3, "fp": 14, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1765, "recall": 0.4286, "f1": 0.25, "f2": 0.3333, "f2_score": 33.3, "f3": 0.375, "f3_score": 37.5, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 22.5, "cvss_fp_weight": 89.6, "cvss_fn_weight": 25.5, "cvss_precision": 0.2006, "cvss_recall": 0.4688, "cvss_f3": 0.4135, "cvss_f3_score": 41.3, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-001", "file": "backend/server.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 4, "fp": 17, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1905, "recall": 0.5714, "f1": 0.2857, "f2": 0.4082, "f2_score": 40.8, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 27.8, "cvss_fp_weight": 110.2, "cvss_fn_weight": 20.2, "cvss_precision": 0.2014, "cvss_recall": 0.5792, "cvss_f3": 0.4877, "cvss_f3_score": 48.8, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-001", "file": "backend/server.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-003", "file": "backend/server.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Auth.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/XssTest.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Login.jsx", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Profile.jsx", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/nosql/Login.jsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 5, "fp": 10, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.7143, "f1": 0.4545, "f2": 0.5814, "f2_score": 58.1, "f3": 0.641, "f3_score": 64.1, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 33.6, "cvss_fp_weight": 80.0, "cvss_fn_weight": 14.4, "cvss_precision": 0.2958, "cvss_recall": 0.7, "cvss_f3": 0.6158, "cvss_f3_score": 61.6, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-002", "file": "backend/server.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-003", "file": "backend/server.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-006", "file": "src/pages/OpenRedirect.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/Xss.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/XssAll.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-001", "file": "backend/server.js", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 5, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.1429, "f1": 0.1538, "f2": 0.1471, "f2_score": 14.7, "f3": 0.1449, "f3_score": 14.5, "tpr": 0.1429, "fpr": 1.0, "youden_j": -0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 27.9, "cvss_fn_weight": 38.9, "cvss_precision": 0.2458, "cvss_recall": 0.1896, "cvss_f3": 0.194, "cvss_f3_score": 19.4, "per_family": { "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 6, "recall": 0.1429 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-react-fatih-004", "file": "backend/server.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/server.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/Search.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/pages/JwtTampering.jsx", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-002", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vulnerable-react-fatih-007", "file": null, "cwe": "CWE-200" } ] }, "sonarqube": null }, "realvuln-vulnerable-rest-api-owasp-2023": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 7, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5625, "recall": 0.6, "f1": 0.5806, "f2": 0.5921, "f2_score": 59.2, "f3": 0.596, "f3_score": 59.6, "tpr": 0.6, "fpr": 1.0, "youden_j": -0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 67.7, "cvss_fp_weight": 50.8, "cvss_fn_weight": 41.2, "cvss_precision": 0.5712, "cvss_recall": 0.6217, "cvss_f3": 0.6162, "cvss_f3_score": 61.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": "server/routes/users.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": "server/routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/authService.js", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 25, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.6667, "f1": 0.4, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.6667, "fpr": 1.0, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 73.6, "cvss_fp_weight": 161.2, "cvss_fn_weight": 35.3, "cvss_precision": 0.3134, "cvss_recall": 0.6758, "cvss_f3": 0.6058, "cvss_f3_score": 60.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/auth.js", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/usersDev.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/cache.js", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/cache.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": "server/routes/auth.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/cert/private_key.key", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/startup/routes.js", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/startup/routes.js", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 20, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.5333, "f1": 0.3721, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4908, "f3_score": 49.1, "tpr": 0.5333, "fpr": 1.0, "youden_j": -0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 60.3, "cvss_fp_weight": 138.4, "cvss_fn_weight": 48.6, "cvss_precision": 0.3034, "cvss_recall": 0.5537, "cvss_f3": 0.5115, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/system.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-524" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/authService.js", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-799" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 7, "fp": 22, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2414, "recall": 0.4667, "f1": 0.3182, "f2": 0.3933, "f2_score": 39.3, "f3": 0.4268, "f3_score": 42.7, "tpr": 0.4667, "fpr": 1.0, "youden_j": -0.5333, "cvss_coverage": 1.0, "cvss_tp_weight": 51.2, "cvss_fp_weight": 132.7, "cvss_fn_weight": 57.7, "cvss_precision": 0.2784, "cvss_recall": 0.4702, "cvss_f3": 0.4399, "cvss_f3_score": 44.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/startup/routes.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-213" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-213" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/cert/private_key.key", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/cache.js", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/system.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/startup/routes.js", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 12, "fp": 51, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1905, "recall": 0.8, "f1": 0.3077, "f2": 0.4878, "f2_score": 48.8, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 89.8, "cvss_fp_weight": 350.0, "cvss_fn_weight": 19.1, "cvss_precision": 0.2042, "cvss_recall": 0.8246, "cvss_f3": 0.6324, "cvss_f3_score": 63.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/auth.js", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/cert/private_key.key", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": "server/routes/me.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": "server/routes/users.js", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": "server/routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/usersDev.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": "server/routes/users.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/authService.js", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 10, "fp": 25, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.6667, "f1": 0.4, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.6667, "fpr": 1.0, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 75.7, "cvss_fp_weight": 181.5, "cvss_fn_weight": 33.2, "cvss_precision": 0.2943, "cvss_recall": 0.6951, "cvss_f3": 0.6118, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": "server/routes/users.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/editProfile.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/userService.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 10, "fp": 27, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2703, "recall": 0.6667, "f1": 0.3846, "f2": 0.5155, "f2_score": 51.5, "f3": 0.5814, "f3_score": 58.1, "tpr": 0.6667, "fpr": 1.0, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 71.0, "cvss_fp_weight": 189.3, "cvss_fn_weight": 37.9, "cvss_precision": 0.2728, "cvss_recall": 0.652, "cvss_f3": 0.5724, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": "server/routes/me.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/cache.js", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/httpService.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/editProfile.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": "server/routes/auth.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 12, "fp": 27, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.8, "f1": 0.4444, "f2": 0.6061, "f2_score": 60.6, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 87.5, "cvss_fp_weight": 196.0, "cvss_fn_weight": 21.4, "cvss_precision": 0.3086, "cvss_recall": 0.8035, "cvss_f3": 0.6925, "cvss_f3_score": 69.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": "server/routes/users.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": "server/routes/me.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/usersDev.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": "server/routes/users.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": "server/routes/auth.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/middleware/cache.js", "cwe": "CWE-524" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/editProfile.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/services/userService.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 14, "fp": 26, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.35, "recall": 0.9333, "f1": 0.5091, "f2": 0.7, "f2_score": 70.0, "f3": 0.8, "f3_score": 80.0, "tpr": 0.9333, "fpr": 1.0, "youden_j": -0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 101.4, "cvss_fp_weight": 203.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.3331, "cvss_recall": 0.9311, "cvss_f3": 0.7894, "cvss_f3_score": 78.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8571 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 1, "recall": 0.9333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/components/about.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": "client/src/components/profile.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": "server/middleware/auth.js", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/models/user.js", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": "server/routes/auth.js", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": "server/routes/me.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/me.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": "server/routes/users.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": "server/routes/users.js", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": "server/routes/users.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": "server/routes/users.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/usersDev.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/adminAuth.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/auth.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": "server/routes/me.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": "server/routes/users.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": "server/routes/users.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": "server/cert/private_key.key", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/log.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/system.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": "server/routes/usersDev.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 25, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 190.4, "cvss_fn_weight": 108.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "server/Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "server/cert/private_key.key", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/migrations/20230820171849-users.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/authors.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/books.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes/users.js", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-003", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-004", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-007", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-010", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-013", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnerable-rest-api-owasp-2023-015", "file": null, "cwe": "CWE-306" } ] }, "sonarqube": null }, "realvuln-vulnerable-tornado-app": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 13, "fp": 10, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5652, "recall": 0.9286, "f1": 0.7027, "f2": 0.8228, "f2_score": 82.3, "f3": 0.8725, "f3_score": 87.2, "tpr": 0.9286, "fpr": 0.7692, "youden_j": 0.1593, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 51.3, "cvss_fn_weight": 7.5, "cvss_precision": 0.6329, "cvss_recall": 0.9218, "cvss_f3": 0.8816, "cvss_f3_score": 88.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 2, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.6429, "f1": 0.72, "f2": 0.6716, "f2_score": 67.2, "f3": 0.6569, "f3_score": 65.7, "tpr": 0.6429, "fpr": 0.4, "youden_j": 0.2429, "cvss_coverage": 1.0, "cvss_tp_weight": 66.4, "cvss_fp_weight": 11.3, "cvss_fn_weight": 29.5, "cvss_precision": 0.8548, "cvss_recall": 0.6924, "cvss_f3": 0.7058, "cvss_f3_score": 70.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-116" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 4, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7094, "recall": 0.6429, "f1": 0.6743, "f2": 0.655, "f2_score": 65.5, "f3": 0.6489, "f3_score": 64.9, "tpr": 0.6429, "fpr": 0.5476, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 64.7, "cvss_fp_weight": 17.3, "cvss_fn_weight": 31.2, "cvss_precision": 0.791, "cvss_recall": 0.675, "cvss_f3": 0.6849, "cvss_f3_score": 68.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 6, "fp": 2, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7223, "recall": 0.4643, "f1": 0.5652, "f2": 0.5, "f2_score": 50.0, "f3": 0.4814, "f3_score": 48.1, "tpr": 0.4643, "fpr": 0.45, "youden_j": 0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 47.9, "cvss_fp_weight": 11.6, "cvss_fn_weight": 48.0, "cvss_precision": 0.8053, "cvss_recall": 0.499, "cvss_f3": 0.5187, "cvss_f3_score": 51.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 2, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.6429, "f1": 0.72, "f2": 0.6716, "f2_score": 67.2, "f3": 0.6569, "f3_score": 65.7, "tpr": 0.6429, "fpr": 0.4, "youden_j": 0.2429, "cvss_coverage": 1.0, "cvss_tp_weight": 63.3, "cvss_fp_weight": 11.3, "cvss_fn_weight": 32.6, "cvss_precision": 0.8487, "cvss_recall": 0.6601, "cvss_f3": 0.6751, "cvss_f3_score": 67.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 4, "fp": 0, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.3095, "f1": 0.4121, "f2": 0.3436, "f2_score": 34.4, "f3": 0.3256, "f3_score": 32.6, "tpr": 0.3095, "fpr": 0.0833, "youden_j": 0.2262, "cvss_coverage": 1.0, "cvss_tp_weight": 33.2, "cvss_fp_weight": 1.9, "cvss_fn_weight": 62.7, "cvss_precision": 0.6349, "cvss_recall": 0.3459, "cvss_f3": 0.362, "cvss_f3_score": 36.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 5, "fp": 0, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3571, "f1": 0.5263, "f2": 0.4098, "f2_score": 41.0, "f3": 0.3817, "f3_score": 38.2, "tpr": 0.3571, "fpr": 0.0, "youden_j": 0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 40.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 55.2, "cvss_precision": 1.0, "cvss_recall": 0.4244, "cvss_f3": 0.4503, "cvss_f3_score": 45.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 10, "fp": 3, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7607, "recall": 0.6905, "f1": 0.7221, "f2": 0.7024, "f2_score": 70.3, "f3": 0.6963, "f3_score": 69.6, "tpr": 0.6905, "fpr": 0.5, "youden_j": 0.1905, "cvss_coverage": 1.0, "cvss_tp_weight": 68.4, "cvss_fp_weight": 13.5, "cvss_fn_weight": 27.5, "cvss_precision": 0.8352, "cvss_recall": 0.7136, "cvss_f3": 0.7237, "cvss_f3_score": 72.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 9, "fp": 3, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7771, "recall": 0.6667, "f1": 0.7152, "f2": 0.6848, "f2_score": 68.5, "f3": 0.6755, "f3_score": 67.6, "tpr": 0.6667, "fpr": 0.4667, "youden_j": 0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 64.3, "cvss_fp_weight": 8.2, "cvss_fn_weight": 31.6, "cvss_precision": 0.8883, "cvss_recall": 0.6705, "cvss_f3": 0.687, "cvss_f3_score": 68.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 10, "fp": 4, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.5714, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 72.5, "cvss_fp_weight": 17.4, "cvss_fn_weight": 23.4, "cvss_precision": 0.8062, "cvss_recall": 0.756, "cvss_f3": 0.7607, "cvss_f3_score": 76.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 7, "fp": 3, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6714, "recall": 0.4762, "f1": 0.5562, "f2": 0.5051, "f2_score": 50.5, "f3": 0.4902, "f3_score": 49.0, "tpr": 0.4762, "fpr": 0.5143, "youden_j": -0.0381, "cvss_coverage": 1.0, "cvss_tp_weight": 49.6, "cvss_fp_weight": 15.4, "cvss_fn_weight": 46.3, "cvss_precision": 0.7642, "cvss_recall": 0.5176, "cvss_f3": 0.5347, "cvss_f3_score": 53.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 7, "fp": 0, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.5, "f1": 0.6667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5, "fpr": 0.0, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 53.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 42.4, "cvss_precision": 1.0, "cvss_recall": 0.5579, "cvss_f3": 0.5837, "cvss_f3_score": 58.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 10, "fp": 8, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7143, "f1": 0.625, "f2": 0.6757, "f2_score": 67.6, "f3": 0.6944, "f3_score": 69.4, "tpr": 0.7143, "fpr": 0.7273, "youden_j": -0.013, "cvss_coverage": 1.0, "cvss_tp_weight": 72.5, "cvss_fp_weight": 40.0, "cvss_fn_weight": 23.4, "cvss_precision": 0.6445, "cvss_recall": 0.756, "cvss_f3": 0.7431, "cvss_f3_score": 74.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 8, "fp": 3, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.5714, "f1": 0.64, "f2": 0.597, "f2_score": 59.7, "f3": 0.5839, "f3_score": 58.4, "tpr": 0.5714, "fpr": 0.5, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 58.9, "cvss_fp_weight": 11.8, "cvss_fn_weight": 37.0, "cvss_precision": 0.8333, "cvss_recall": 0.6142, "cvss_f3": 0.6308, "cvss_f3_score": 63.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 9, "fp": 9, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.6429, "f1": 0.5625, "f2": 0.6081, "f2_score": 60.8, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6429, "fpr": 0.75, "youden_j": -0.1071, "cvss_coverage": 1.0, "cvss_tp_weight": 65.0, "cvss_fp_weight": 45.6, "cvss_fn_weight": 30.9, "cvss_precision": 0.5875, "cvss_recall": 0.6778, "cvss_f3": 0.6675, "cvss_f3_score": 66.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 10, "fp": 8, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.7143, "f1": 0.625, "f2": 0.6757, "f2_score": 67.6, "f3": 0.6944, "f3_score": 69.4, "tpr": 0.7143, "fpr": 0.7273, "youden_j": -0.013, "cvss_coverage": 1.0, "cvss_tp_weight": 73.9, "cvss_fp_weight": 40.0, "cvss_fn_weight": 22.0, "cvss_precision": 0.6489, "cvss_recall": 0.7706, "cvss_f3": 0.7564, "cvss_f3_score": 75.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 6, "fp": 2, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8167, "recall": 0.4524, "f1": 0.5763, "f2": 0.4943, "f2_score": 49.4, "f3": 0.4723, "f3_score": 47.3, "tpr": 0.4524, "fpr": 0.3, "youden_j": 0.1524, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 7.7, "cvss_fn_weight": 46.2, "cvss_precision": 0.8754, "cvss_recall": 0.5183, "cvss_f3": 0.5397, "cvss_f3_score": 54.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 7, "fp": 2, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.5, "f1": 0.6087, "f2": 0.5385, "f2_score": 53.8, "f3": 0.5185, "f3_score": 51.9, "tpr": 0.5, "fpr": 0.4, "youden_j": 0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 51.5, "cvss_fp_weight": 11.3, "cvss_fn_weight": 44.4, "cvss_precision": 0.8204, "cvss_recall": 0.5374, "cvss_f3": 0.5566, "cvss_f3_score": 55.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 8, "fp": 2, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7758, "recall": 0.5714, "f1": 0.6578, "f2": 0.6031, "f2_score": 60.3, "f3": 0.5868, "f3_score": 58.7, "tpr": 0.5714, "fpr": 0.4333, "youden_j": 0.1381, "cvss_coverage": 1.0, "cvss_tp_weight": 56.0, "cvss_fp_weight": 9.7, "cvss_fn_weight": 39.9, "cvss_precision": 0.8521, "cvss_recall": 0.5836, "cvss_f3": 0.6026, "cvss_f3_score": 60.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 4, "recall": 0.4286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 10, "fp": 3, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.7143, "f1": 0.7407, "f2": 0.7246, "f2_score": 72.5, "f3": 0.7194, "f3_score": 71.9, "tpr": 0.7143, "fpr": 0.5, "youden_j": 0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 67.3, "cvss_fp_weight": 16.9, "cvss_fn_weight": 28.6, "cvss_precision": 0.7991, "cvss_recall": 0.7018, "cvss_f3": 0.7104, "cvss_f3_score": 71.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 8, "fp": 1, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5714, "f1": 0.6957, "f2": 0.6154, "f2_score": 61.5, "f3": 0.5926, "f3_score": 59.3, "tpr": 0.5714, "fpr": 0.25, "youden_j": 0.3214, "cvss_coverage": 1.0, "cvss_tp_weight": 61.0, "cvss_fp_weight": 8.0, "cvss_fn_weight": 34.9, "cvss_precision": 0.8841, "cvss_recall": 0.6361, "cvss_f3": 0.6544, "cvss_f3_score": 65.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 13, "fp": 29, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3095, "recall": 0.9286, "f1": 0.4643, "f2": 0.6633, "f2_score": 66.3, "f3": 0.7738, "f3_score": 77.4, "tpr": 0.9286, "fpr": 0.9062, "youden_j": 0.0223, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 190.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.3175, "cvss_recall": 0.9218, "cvss_f3": 0.7744, "cvss_f3_score": 77.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 13, "fp": 14, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4815, "recall": 0.9286, "f1": 0.6341, "f2": 0.7831, "f2_score": 78.3, "f3": 0.8497, "f3_score": 85.0, "tpr": 0.9286, "fpr": 0.8235, "youden_j": 0.105, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 93.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.4873, "cvss_recall": 0.9218, "cvss_f3": 0.8463, "cvss_f3_score": 84.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 1, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-1327" }, { "classification": "FP", "ground_truth_id": null, "file": "test.db", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 5, "fp": 0, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3571, "f1": 0.5263, "f2": 0.4098, "f2_score": 41.0, "f3": 0.3817, "f3_score": 38.2, "tpr": 0.3571, "fpr": 0.0, "youden_j": 0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 40.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 55.2, "cvss_precision": 1.0, "cvss_recall": 0.4244, "cvss_f3": 0.4503, "cvss_f3_score": 45.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 14, "fp": 34, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2917, "recall": 1.0, "f1": 0.4516, "f2": 0.6731, "f2_score": 67.3, "f3": 0.8046, "f3_score": 80.5, "tpr": 1.0, "fpr": 0.9189, "youden_j": 0.0811, "cvss_coverage": 1.0, "cvss_tp_weight": 95.9, "cvss_fp_weight": 266.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.265, "cvss_recall": 1.0, "cvss_f3": 0.7829, "cvss_f3_score": 78.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-013", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "static/owl-carousel/owl.carousel.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/owl-carousel/owl.carousel.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/server.html", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 13, "fp": 7, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.9286, "f1": 0.7647, "f2": 0.8553, "f2_score": 85.5, "f3": 0.8904, "f3_score": 89.0, "tpr": 0.9286, "fpr": 0.7, "youden_j": 0.2286, "cvss_coverage": 1.0, "cvss_tp_weight": 89.8, "cvss_fp_weight": 51.0, "cvss_fn_weight": 6.1, "cvss_precision": 0.6378, "cvss_recall": 0.9364, "cvss_f3": 0.8945, "cvss_f3_score": 89.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 1, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/jquery1111.min.js", "cwe": "CWE-1395" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-013", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 6, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.6429, "f1": 0.6207, "f2": 0.6338, "f2_score": 63.4, "f3": 0.6383, "f3_score": 63.8, "tpr": 0.6429, "fpr": 0.6667, "youden_j": -0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 64.2, "cvss_fp_weight": 36.0, "cvss_fn_weight": 31.7, "cvss_precision": 0.6407, "cvss_recall": 0.6694, "cvss_f3": 0.6665, "cvss_f3_score": 66.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 2, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 14, "fp": 38, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2692, "recall": 1.0, "f1": 0.4242, "f2": 0.6481, "f2_score": 64.8, "f3": 0.7865, "f3_score": 78.7, "tpr": 1.0, "fpr": 0.9268, "youden_j": 0.0732, "cvss_coverage": 1.0, "cvss_tp_weight": 95.9, "cvss_fp_weight": 290.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.2482, "cvss_recall": 1.0, "cvss_f3": 0.7675, "cvss_f3_score": 76.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "requirements.txt", "cwe": "CWE-1104" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-009", "file": "server.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-013", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-012", "file": "server.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-014", "file": "server.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-011", "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-008", "file": "server.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "static/owl-carousel/owl.carousel.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "static/owl-carousel/owl.carousel.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-549" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/server.html", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 6, "fp": 2, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8056, "recall": 0.4524, "f1": 0.578, "f2": 0.4953, "f2_score": 49.6, "f3": 0.4728, "f3_score": 47.3, "tpr": 0.4524, "fpr": 0.3, "youden_j": 0.1524, "cvss_coverage": 1.0, "cvss_tp_weight": 48.5, "cvss_fp_weight": 9.4, "cvss_fn_weight": 47.4, "cvss_precision": 0.8447, "cvss_recall": 0.5058, "cvss_f3": 0.5267, "cvss_f3_score": 52.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 2, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-006", "file": "server.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 5, "fp": 3, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.3571, "f1": 0.4545, "f2": 0.3906, "f2_score": 39.1, "f3": 0.3731, "f3_score": 37.3, "tpr": 0.3571, "fpr": 0.5, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 40.7, "cvss_fp_weight": 6.6, "cvss_fn_weight": 55.2, "cvss_precision": 0.8597, "cvss_recall": 0.4244, "cvss_f3": 0.447, "cvss_f3_score": 44.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 5, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 7, "fp": 5, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.5, "f1": 0.5385, "f2": 0.5147, "f2_score": 51.5, "f3": 0.5072, "f3_score": 50.7, "tpr": 0.5, "fpr": 0.625, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 55.7, "cvss_fp_weight": 23.1, "cvss_fn_weight": 40.2, "cvss_precision": 0.7072, "cvss_recall": 0.5808, "cvss_f3": 0.5914, "cvss_f3_score": 59.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 3, "recall": 0.5714 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 3, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-005", "file": "server.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-003", "file": "server.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-002", "file": "server.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-010", "file": "server.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-007", "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-004", "file": "server.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "rowan": { "scanner": "rowan", "tp": 1, "fp": 5, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.0714, "f1": 0.1, "f2": 0.0806, "f2_score": 8.1, "f3": 0.0758, "f3_score": 7.6, "tpr": 0.0714, "fpr": 0.625, "youden_j": -0.5536, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 8.5, "cvss_fn_weight": 86.1, "cvss_precision": 0.5355, "cvss_recall": 0.1022, "cvss_f3": 0.1112, "cvss_f3_score": 11.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/jquery1111.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/lightbox-plus-jquery.min.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/lightbox-plus-jquery.min.js", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/lightbox-plus-jquery.min.js", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/html5.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-003", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 8, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1111, "recall": 0.0714, "f1": 0.087, "f2": 0.0769, "f2_score": 7.7, "f3": 0.0741, "f3_score": 7.4, "tpr": 0.0714, "fpr": 0.7273, "youden_j": -0.6558, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 45.1, "cvss_fn_weight": 86.1, "cvss_precision": 0.1784, "cvss_recall": 0.1022, "cvss_f3": 0.1068, "cvss_f3_score": 10.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnerable-tornado-app-001", "file": "server.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "static/js/html5.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/index.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/index.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/login.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/search.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/server.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/server.html", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-003", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 0, "fp": 0, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 95.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 7, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 4, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-003", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-006", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-009", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-011", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-012", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnerable-tornado-app-014", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-001", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-002", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnerable-tornado-app-fp-003", "file": null, "cwe": "CWE-79" } ] } }, "realvuln-vulnnodeapp": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 11, "fp": 9, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.55, "recall": 0.3793, "f1": 0.449, "f2": 0.4044, "f2_score": 40.4, "f3": 0.3915, "f3_score": 39.1, "tpr": 0.3793, "fpr": 1.0, "youden_j": -0.6207, "cvss_coverage": 1.0, "cvss_tp_weight": 76.1, "cvss_fp_weight": 42.4, "cvss_fn_weight": 95.6, "cvss_precision": 0.642, "cvss_recall": 0.4432, "cvss_f3": 0.4574, "cvss_f3_score": 45.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-477" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 16, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.4138, "f1": 0.4211, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4152, "f3_score": 41.5, "tpr": 0.4138, "fpr": 1.0, "youden_j": -0.5862, "cvss_coverage": 1.0, "cvss_tp_weight": 84.6, "cvss_fp_weight": 78.5, "cvss_fn_weight": 87.1, "cvss_precision": 0.5188, "cvss_recall": 0.4927, "cvss_f3": 0.4952, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-004", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-026", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 9, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.4138, "f1": 0.48, "f2": 0.438, "f2_score": 43.8, "f3": 0.4255, "f3_score": 42.6, "tpr": 0.4138, "fpr": 1.0, "youden_j": -0.5862, "cvss_coverage": 1.0, "cvss_tp_weight": 82.9, "cvss_fp_weight": 42.4, "cvss_fn_weight": 88.8, "cvss_precision": 0.6614, "cvss_recall": 0.4828, "cvss_f3": 0.4962, "cvss_f3_score": 49.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-004", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 13, "fp": 11, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5417, "recall": 0.4483, "f1": 0.4906, "f2": 0.4643, "f2_score": 46.4, "f3": 0.4561, "f3_score": 45.6, "tpr": 0.4483, "fpr": 1.0, "youden_j": -0.5517, "cvss_coverage": 1.0, "cvss_tp_weight": 90.1, "cvss_fp_weight": 65.1, "cvss_fn_weight": 81.6, "cvss_precision": 0.5804, "cvss_recall": 0.5248, "cvss_f3": 0.5298, "cvss_f3_score": 53.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 11, "recall": 0.5217 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/index.js", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-026", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 14, "fp": 22, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 0.4828, "f1": 0.4308, "f2": 0.4605, "f2_score": 46.1, "f3": 0.4714, "f3_score": 47.1, "tpr": 0.4828, "fpr": 1.0, "youden_j": -0.5172, "cvss_coverage": 1.0, "cvss_tp_weight": 95.9, "cvss_fp_weight": 124.8, "cvss_fn_weight": 75.8, "cvss_precision": 0.4345, "cvss_recall": 0.5585, "cvss_f3": 0.543, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 10, "recall": 0.5652 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-009", "file": "models/usersModel.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-026", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 16, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6098, "recall": 0.8621, "f1": 0.7143, "f2": 0.7962, "f2_score": 79.6, "f3": 0.8278, "f3_score": 82.8, "tpr": 0.8621, "fpr": 1.0, "youden_j": -0.1379, "cvss_coverage": 1.0, "cvss_tp_weight": 150.5, "cvss_fp_weight": 89.3, "cvss_fn_weight": 21.2, "cvss_precision": 0.6276, "cvss_recall": 0.8765, "cvss_f3": 0.8431, "cvss_f3_score": 84.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 4, "recall": 0.8261 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-003", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-004", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/config.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/index.js", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-012", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-014", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-016", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-018", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-024", "file": "views/blind-sqli-blacklist.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-025", "file": "views/blind-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-027", "file": "views/reflected-xss.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-028", "file": "views/second-order-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-029", "file": "views/xss-exercise.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 15, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4828, "recall": 0.4828, "f1": 0.4828, "f2": 0.4828, "f2_score": 48.3, "f3": 0.4828, "f3_score": 48.3, "tpr": 0.4828, "fpr": 1.0, "youden_j": -0.5172, "cvss_coverage": 1.0, "cvss_tp_weight": 99.2, "cvss_fp_weight": 88.8, "cvss_fn_weight": 72.5, "cvss_precision": 0.5276, "cvss_recall": 0.5778, "cvss_f3": 0.5723, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 10, "recall": 0.5652 }, "low": { "tp": 1, "fp": 0, "fn": 5, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "controllers/usersController.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-730" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-003", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/index.js", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-026", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-029", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 26, "fp": 9, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7429, "recall": 0.8966, "f1": 0.8125, "f2": 0.8609, "f2_score": 86.1, "f3": 0.8784, "f3_score": 87.8, "tpr": 0.8966, "fpr": 1.0, "youden_j": -0.1034, "cvss_coverage": 1.0, "cvss_tp_weight": 154.8, "cvss_fp_weight": 53.3, "cvss_fn_weight": 16.9, "cvss_precision": 0.7439, "cvss_recall": 0.9016, "cvss_f3": 0.8829, "cvss_f3_score": 88.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 3, "recall": 0.8696 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-001", "file": "app.js", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-003", "file": "app.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-004", "file": "app.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "models/usersModel.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-012", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-013", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-014", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-015", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-016", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-017", "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-018", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-021", "file": "utils/utility.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-024", "file": "views/blind-sqli-blacklist.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-025", "file": "views/blind-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-027", "file": "views/reflected-xss.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-028", "file": "views/second-order-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-029", "file": "views/xss-exercise.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "views/xxe.ejs", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 20, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.8621, "f1": 0.6757, "f2": 0.7764, "f2_score": 77.6, "f3": 0.817, "f3_score": 81.7, "tpr": 0.8621, "fpr": 1.0, "youden_j": -0.1379, "cvss_coverage": 1.0, "cvss_tp_weight": 144.2, "cvss_fp_weight": 144.0, "cvss_fn_weight": 27.5, "cvss_precision": 0.5003, "cvss_recall": 0.8398, "cvss_f3": 0.7865, "cvss_f3_score": 78.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 4, "recall": 0.8261 }, "low": { "tp": 6, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnnodeapp-004", "file": "app.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-005", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-006", "file": "models/usersModel.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-007", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-008", "file": "models/usersModel.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-009", "file": "models/usersModel.js", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-010", "file": "models/usersModel.js", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-011", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-012", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-014", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-016", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-018", "file": "routes/users/user.js", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-022", "file": "utils/utility.js", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-023", "file": "utils/utility.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "views/arbitrary-file-retrieval.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-024", "file": "views/blind-sqli-blacklist.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-025", "file": "views/blind-sqli.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/change-password.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/command-injection.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/deserialization.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/error.ejs", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "views/index.ejs", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-027", "file": "views/reflected-xss.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/regex-injection.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-028", "file": "views/second-order-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-029", "file": "views/xss-exercise.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/xxe.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/xxe.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-002", "file": "app.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-021", "file": "utils/utility.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-003", "file": "app.js", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-001", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-017", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 8, "fp": 355, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.022, "recall": 0.2759, "f1": 0.0408, "f2": 0.0835, "f2_score": 8.4, "f3": 0.1282, "f3_score": 12.8, "tpr": 0.2759, "fpr": 1.0, "youden_j": -0.7241, "cvss_coverage": 1.0, "cvss_tp_weight": 44.0, "cvss_fp_weight": 2063.9, "cvss_fn_weight": 127.7, "cvss_precision": 0.0209, "cvss_recall": 0.2563, "cvss_f3": 0.1204, "cvss_f3_score": 12.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 }, "low": { "tp": 0, "fp": 0, "fn": 6, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bin/www", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap-slider/bootstrap-slider.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap-slider/bootstrap-slider.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap/js/bootstrap.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap/js/bootstrap.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap4-duallistbox/jquery.bootstrap-duallistbox.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/bootstrap4-duallistbox/jquery.bootstrap-duallistbox.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/chart.js/Chart.bundle.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/chart.js/Chart.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/buttons.html5.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/dataTables.buttons.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-buttons/js/dataTables.buttons.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables-responsive/js/dataTables.responsive.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/example/amd/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/example/amd/main.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/example/amd/require.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/example/browserify/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/example/browserify/main.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/index.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/daterangepicker/website/website.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/flot/jquery.flot.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/flot/jquery.flot.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery-validation/jquery.validate.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/custom-load-indicator.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/jsgrid.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/jsgrid.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/jsgrid/jsgrid.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/moment/moment-with-locales.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap-slider/bootstrap-slider.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap-slider/bootstrap-slider.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap/js/bootstrap.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap/js/bootstrap.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap4-duallistbox/jquery.bootstrap-duallistbox.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/bootstrap4-duallistbox/jquery.bootstrap-duallistbox.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/chart.js/Chart.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/buttons.flash.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/buttons.html5.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/dataTables.buttons.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-buttons/js/dataTables.buttons.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables-responsive/js/dataTables.responsive.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/datatables/jquery.dataTables.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/example/amd/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/example/amd/main.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/example/amd/require.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/example/browserify/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/example/browserify/main.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/index.html", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/daterangepicker/website/website.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/flot/jquery.flot.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/flot/jquery.flot.js", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/inputmask/inputmask.numeric.extensions.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/inputmask/jquery.inputmask.bundle.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/external/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-ui/jquery-ui.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/additional-methods.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery-validation/jquery.validate.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jquery/jquery.slim.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/custom-grid-field.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/custom-load-indicator.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/data-manipulation.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/demos/rows-reordering.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/jsgrid.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/jsgrid.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/jsgrid/jsgrid.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/moment/moment-with-locales.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/raphael/raphael.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/raphael/raphael.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/select2/js/select2.full.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/select2/js/select2.full.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/select2/js/select2.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/plugins/select2/js/select2.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/select2/js/select2.full.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/select2/js/select2.full.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/select2/js/select2.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "public/plugins/select2/js/select2.js", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "routes/users/user.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/mysqlConnectionPool.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/mysqlConnectionPool.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-019", "file": "utils/utility.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-020", "file": "utils/utility.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/utility.js", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "views/arbitrary-file-retrieval.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-024", "file": "views/blind-sqli-blacklist.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-025", "file": "views/blind-sqli.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/body-header.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/change-password.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/command-injection.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/deserialization.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-026", "file": "views/navigation.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-027", "file": "views/reflected-xss.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/regex-injection.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-028", "file": "views/second-order-sqli.ejs", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnnodeapp-029", "file": "views/xss-exercise.ejs", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views/xxe.ejs", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-001", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-004", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-006", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-009", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-012", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-016", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-018", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-021", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnnodeapp-023", "file": null, "cwe": "CWE-502" } ] }, "sonarqube": null }, "realvuln-vulnpy": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 49, "fp": 16, "fn": 31, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.7538, "recall": 0.6125, "f1": 0.6759, "f2": 0.6364, "f2_score": 63.6, "f3": 0.6242, "f3_score": 62.4, "tpr": 0.6125, "fpr": 0.5, "youden_j": 0.1125, "cvss_coverage": 1.0, "cvss_tp_weight": 347.8, "cvss_fp_weight": 97.0, "cvss_fn_weight": 194.3, "cvss_precision": 0.782, "cvss_recall": 0.6416, "cvss_f3": 0.6533, "cvss_f3_score": 65.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 16, "fp": 0, "fn": 11, "recall": 0.5926 }, "low": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/common/templating.py", "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 49, "fp": 7, "fn": 31, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.6125, "f1": 0.7206, "f2": 0.6516, "f2_score": 65.2, "f3": 0.6314, "f3_score": 63.1, "tpr": 0.6125, "fpr": 0.3043, "youden_j": 0.3082, "cvss_coverage": 1.0, "cvss_tp_weight": 349.4, "cvss_fp_weight": 16.2, "cvss_fn_weight": 192.7, "cvss_precision": 0.9557, "cvss_recall": 0.6445, "cvss_f3": 0.6662, "cvss_f3_score": 66.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 16, "fp": 0, "fn": 11, "recall": 0.5926 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 17, "fp": 0, "fn": 14, "recall": 0.5484 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 63, "fp": 15, "fn": 17, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.8095, "recall": 0.7875, "f1": 0.7951, "f2": 0.7897, "f2_score": 79.0, "f3": 0.7885, "f3_score": 78.8, "tpr": 0.7875, "fpr": 0.495, "youden_j": 0.2925, "cvss_coverage": 1.0, "cvss_tp_weight": 423.6, "cvss_fp_weight": 77.4, "cvss_fn_weight": 118.5, "cvss_precision": 0.8482, "cvss_recall": 0.7815, "cvss_f3": 0.7869, "cvss_f3_score": 78.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 5, "fp": 1, "fn": 8, "precision": 0.8333, "recall": 0.3846 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 18, "fp": 1, "fn": 9, "recall": 0.6667 }, "low": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-003", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 48, "fp": 8, "fn": 32, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.876, "recall": 0.6, "f1": 0.709, "f2": 0.6388, "f2_score": 63.9, "f3": 0.6188, "f3_score": 61.9, "tpr": 0.6, "fpr": 0.2963, "youden_j": 0.3037, "cvss_coverage": 1.0, "cvss_tp_weight": 337.5, "cvss_fp_weight": 38.7, "cvss_fn_weight": 204.6, "cvss_precision": 0.9033, "cvss_recall": 0.6227, "cvss_f3": 0.6421, "cvss_f3_score": 64.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "high": { "tp": 15, "fp": 0, "fn": 12, "recall": 0.5556 }, "low": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 50, "fp": 20, "fn": 30, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.625, "f1": 0.6667, "f2": 0.641, "f2_score": 64.1, "f3": 0.6329, "f3_score": 63.3, "tpr": 0.625, "fpr": 0.5556, "youden_j": 0.0694, "cvss_coverage": 1.0, "cvss_tp_weight": 357.6, "cvss_fp_weight": 130.7, "cvss_fn_weight": 184.5, "cvss_precision": 0.7323, "cvss_recall": 0.6597, "cvss_f3": 0.6663, "cvss_f3_score": 66.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 11, "recall": 0.5926 }, "low": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-453" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 27, "fp": 1, "fn": 53, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.9598, "recall": 0.3333, "f1": 0.484, "f2": 0.3801, "f2_score": 38.0, "f3": 0.3551, "f3_score": 35.5, "tpr": 0.3333, "fpr": 0.0625, "youden_j": 0.2708, "cvss_coverage": 1.0, "cvss_tp_weight": 192.1, "cvss_fp_weight": 6.9, "cvss_fn_weight": 350.0, "cvss_precision": 0.962, "cvss_recall": 0.3544, "cvss_f3": 0.3767, "cvss_f3_score": 37.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 1, "fn": 6, "precision": 0.6667, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "high": { "tp": 6, "fp": 1, "fn": 21, "recall": 0.2222 }, "low": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 3, "fp": 0, "fn": 28, "recall": 0.0968 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-047", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 23, "fp": 0, "fn": 57, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2875, "f1": 0.4466, "f2": 0.3353, "f2_score": 33.5, "f3": 0.3096, "f3_score": 31.0, "tpr": 0.2875, "fpr": 0.0, "youden_j": 0.2875, "cvss_coverage": 1.0, "cvss_tp_weight": 174.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 367.8, "cvss_precision": 1.0, "cvss_recall": 0.3215, "cvss_f3": 0.3449, "cvss_f3_score": 34.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 9, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 20, "recall": 0.2593 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 10, "fp": 0, "fn": 21, "recall": 0.3226 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 63, "fp": 5, "fn": 17, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.9176, "recall": 0.7917, "f1": 0.8489, "f2": 0.8134, "f2_score": 81.4, "f3": 0.8024, "f3_score": 80.2, "tpr": 0.7917, "fpr": 0.2425, "youden_j": 0.5491, "cvss_coverage": 1.0, "cvss_tp_weight": 428.6, "cvss_fp_weight": 17.5, "cvss_fn_weight": 113.5, "cvss_precision": 0.9582, "cvss_recall": 0.7907, "cvss_f3": 0.8045, "cvss_f3_score": 80.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 1, "fn": 1, "precision": 0.875, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 6, "fp": 1, "fn": 7, "precision": 0.8571, "recall": 0.4615 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 19, "fp": 2, "fn": 8, "recall": 0.7037 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-003", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 26, "fp": 4, "fn": 54, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.2862, "recall": 0.3292, "f1": 0.3062, "f2": 0.3196, "f2_score": 32.0, "f3": 0.3243, "f3_score": 32.4, "tpr": 0.3292, "fpr": 0.1494, "youden_j": 0.1797, "cvss_coverage": 1.0, "cvss_tp_weight": 179.5, "cvss_fp_weight": 21.2, "cvss_fn_weight": 362.6, "cvss_precision": 0.2981, "cvss_recall": 0.3311, "cvss_f3": 0.3274, "cvss_f3_score": 32.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 13, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 27, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 31, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-564" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-023", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-024", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-025", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-026", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-028", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-030", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-87" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 52, "fp": 25, "fn": 28, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.6753, "recall": 0.65, "f1": 0.6624, "f2": 0.6549, "f2_score": 65.5, "f3": 0.6524, "f3_score": 65.2, "tpr": 0.65, "fpr": 0.6098, "youden_j": 0.0402, "cvss_coverage": 1.0, "cvss_tp_weight": 371.1, "cvss_fp_weight": 145.9, "cvss_fn_weight": 171.0, "cvss_precision": 0.7177, "cvss_recall": 0.6846, "cvss_f3": 0.6877, "cvss_f3_score": 68.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 17, "fp": 0, "fn": 10, "recall": 0.6296 }, "low": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 17, "fp": 0, "fn": 14, "recall": 0.5484 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 61, "fp": 13, "fn": 19, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8285, "recall": 0.7583, "f1": 0.7895, "f2": 0.77, "f2_score": 77.0, "f3": 0.764, "f3_score": 76.4, "tpr": 0.7583, "fpr": 0.4361, "youden_j": 0.3222, "cvss_coverage": 1.0, "cvss_tp_weight": 413.5, "cvss_fp_weight": 55.0, "cvss_fn_weight": 128.6, "cvss_precision": 0.8846, "cvss_recall": 0.7628, "cvss_f3": 0.7728, "cvss_f3_score": 77.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 17, "fp": 0, "fn": 10, "recall": 0.6296 }, "low": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 31, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 4, "fn": 64, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.2, "f1": 0.32, "f2": 0.2353, "f2_score": 23.5, "f3": 0.2162, "f3_score": 21.6, "tpr": 0.2, "fpr": 0.2, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 131.5, "cvss_fp_weight": 8.4, "cvss_fn_weight": 410.6, "cvss_precision": 0.9403, "cvss_recall": 0.2426, "cvss_f3": 0.262, "cvss_f3_score": 26.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "high": { "tp": 7, "fp": 0, "fn": 20, "recall": 0.2593 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 28, "recall": 0.0968 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-041", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-047", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 55, "fp": 12, "fn": 25, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8209, "recall": 0.6875, "f1": 0.7483, "f2": 0.7106, "f2_score": 71.1, "f3": 0.6989, "f3_score": 69.9, "tpr": 0.6875, "fpr": 0.4286, "youden_j": 0.2589, "cvss_coverage": 1.0, "cvss_tp_weight": 380.3, "cvss_fp_weight": 56.8, "cvss_fn_weight": 161.8, "cvss_precision": 0.87, "cvss_recall": 0.7015, "cvss_f3": 0.7154, "cvss_f3_score": 71.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 13, "fp": 0, "fn": 14, "recall": 0.4815 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 30, "fp": 0, "fn": 1, "recall": 0.9677 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 33, "fp": 7, "fn": 47, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.825, "recall": 0.4125, "f1": 0.55, "f2": 0.4583, "f2_score": 45.8, "f3": 0.4342, "f3_score": 43.4, "tpr": 0.4125, "fpr": 0.3043, "youden_j": 0.1082, "cvss_coverage": 1.0, "cvss_tp_weight": 253.5, "cvss_fp_weight": 22.6, "cvss_fn_weight": 288.6, "cvss_precision": 0.9183, "cvss_recall": 0.4676, "cvss_f3": 0.4918, "cvss_f3_score": 49.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 10, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8333 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 8, "fp": 0, "fn": 19, "recall": 0.2963 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 14, "fp": 0, "fn": 17, "recall": 0.4516 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 36, "fp": 6, "fn": 44, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.45, "f1": 0.5902, "f2": 0.4972, "f2_score": 49.7, "f3": 0.4724, "f3_score": 47.2, "tpr": 0.45, "fpr": 0.2727, "youden_j": 0.1773, "cvss_coverage": 1.0, "cvss_tp_weight": 275.9, "cvss_fp_weight": 41.1, "cvss_fn_weight": 266.2, "cvss_precision": 0.8703, "cvss_recall": 0.5089, "cvss_f3": 0.531, "cvss_f3_score": 53.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 11, "fp": 0, "fn": 16, "recall": 0.4074 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 13, "fp": 0, "fn": 18, "recall": 0.4194 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 40, "fp": 9, "fn": 40, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8163, "recall": 0.5, "f1": 0.6202, "f2": 0.542, "f2_score": 54.2, "f3": 0.5202, "f3_score": 52.0, "tpr": 0.5, "fpr": 0.36, "youden_j": 0.14, "cvss_coverage": 1.0, "cvss_tp_weight": 302.4, "cvss_fp_weight": 61.7, "cvss_fn_weight": 239.7, "cvss_precision": 0.8306, "cvss_recall": 0.5578, "cvss_f3": 0.5768, "cvss_f3_score": 57.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 13, "fp": 0, "fn": 14, "recall": 0.4815 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 57, "fp": 3, "fn": 23, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.9412, "recall": 0.7125, "f1": 0.8039, "f2": 0.7452, "f2_score": 74.5, "f3": 0.7283, "f3_score": 72.8, "tpr": 0.7125, "fpr": 0.1551, "youden_j": 0.5574, "cvss_coverage": 1.0, "cvss_tp_weight": 394.1, "cvss_fp_weight": 20.7, "cvss_fn_weight": 148.0, "cvss_precision": 0.9469, "cvss_recall": 0.727, "cvss_f3": 0.7429, "cvss_f3_score": 74.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 5, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3846 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "high": { "tp": 18, "fp": 0, "fn": 9, "recall": 0.6667 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 16, "fp": 0, "fn": 15, "recall": 0.5161 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 69, "fp": 7, "fn": 11, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.9062, "recall": 0.8625, "f1": 0.882, "f2": 0.8699, "f2_score": 87.0, "f3": 0.8661, "f3_score": 86.6, "tpr": 0.8625, "fpr": 0.3183, "youden_j": 0.5442, "cvss_coverage": 1.0, "cvss_tp_weight": 472.3, "cvss_fp_weight": 31.2, "cvss_fn_weight": 69.8, "cvss_precision": 0.9384, "cvss_recall": 0.8713, "cvss_f3": 0.8776, "cvss_f3_score": 87.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 1, "fn": 0, "precision": 0.8889, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 13, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 10, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8333 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 26, "fp": 1, "fn": 1, "recall": 0.963 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 25, "fp": 0, "fn": 6, "recall": 0.8065 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-023", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-024", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-025", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-026", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-028", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-030", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 37, "fp": 8, "fn": 43, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8629, "recall": 0.4583, "f1": 0.5825, "f2": 0.4992, "f2_score": 49.9, "f3": 0.4776, "f3_score": 47.8, "tpr": 0.4583, "fpr": 0.2585, "youden_j": 0.1998, "cvss_coverage": 1.0, "cvss_tp_weight": 276.0, "cvss_fp_weight": 35.6, "cvss_fn_weight": 266.1, "cvss_precision": 0.9003, "cvss_recall": 0.5092, "cvss_f3": 0.5308, "cvss_f3_score": 53.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 10, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7692 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "high": { "tp": 21, "fp": 0, "fn": 6, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 20, "recall": 0.3548 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-024", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnpy-023", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-025", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-026", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-031", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 61, "fp": 10, "fn": 19, "tn": 14, "ns": 0, "ns_gt": 0, "precision": 0.8592, "recall": 0.7625, "f1": 0.8079, "f2": 0.7801, "f2_score": 78.0, "f3": 0.7712, "f3_score": 77.1, "tpr": 0.7625, "fpr": 0.4167, "youden_j": 0.3458, "cvss_coverage": 1.0, "cvss_tp_weight": 415.3, "cvss_fp_weight": 36.8, "cvss_fn_weight": 126.8, "cvss_precision": 0.9187, "cvss_recall": 0.7661, "cvss_f3": 0.779, "cvss_f3_score": 77.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 1, "fn": 1, "precision": 0.875, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 5, "fp": 1, "fn": 8, "precision": 0.8333, "recall": 0.3846 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 19, "fp": 2, "fn": 8, "recall": 0.7037 }, "low": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 22, "fp": 0, "fn": 9, "recall": 0.7097 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-003", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 33, "fp": 13, "fn": 47, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.7174, "recall": 0.4125, "f1": 0.5238, "f2": 0.4508, "f2_score": 45.1, "f3": 0.4308, "f3_score": 43.1, "tpr": 0.4125, "fpr": 0.4483, "youden_j": -0.0358, "cvss_coverage": 1.0, "cvss_tp_weight": 234.9, "cvss_fp_weight": 80.0, "cvss_fn_weight": 307.2, "cvss_precision": 0.746, "cvss_recall": 0.4333, "cvss_f3": 0.4523, "cvss_f3_score": 45.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "high": { "tp": 9, "fp": 0, "fn": 18, "recall": 0.3333 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 20, "recall": 0.3548 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 42, "fp": 59, "fn": 38, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.4158, "recall": 0.525, "f1": 0.4641, "f2": 0.4988, "f2_score": 49.9, "f3": 0.5116, "f3_score": 51.2, "tpr": 0.525, "fpr": 0.7867, "youden_j": -0.2617, "cvss_coverage": 1.0, "cvss_tp_weight": 285.6, "cvss_fp_weight": 451.0, "cvss_fn_weight": 256.5, "cvss_precision": 0.3877, "cvss_recall": 0.5268, "cvss_f3": 0.5086, "cvss_f3_score": 50.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "denial_of_service": { "label": "Denial of Service", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "high": { "tp": 10, "fp": 0, "fn": 17, "recall": 0.3704 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 19, "fp": 0, "fn": 12, "recall": 0.6129 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-453" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "Makefile", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_two_apps.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 31, "fp": 44, "fn": 49, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.4133, "recall": 0.3875, "f1": 0.4, "f2": 0.3924, "f2_score": 39.2, "f3": 0.3899, "f3_score": 39.0, "tpr": 0.3875, "fpr": 0.7458, "youden_j": -0.3583, "cvss_coverage": 1.0, "cvss_tp_weight": 220.1, "cvss_fp_weight": 334.5, "cvss_fn_weight": 322.0, "cvss_precision": 0.3969, "cvss_recall": 0.406, "cvss_f3": 0.4051, "cvss_f3_score": 40.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 2, "precision": 0.5, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "high": { "tp": 7, "fp": 1, "fn": 20, "recall": 0.2593 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 12, "fp": 0, "fn": 19, "recall": 0.3871 } }, "details": [ { "classification": "FP", "ground_truth_id": "vulnpy-fp-001", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-453" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 19, "fp": 6, "fn": 61, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.2375, "f1": 0.3619, "f2": 0.2754, "f2_score": 27.5, "f3": 0.255, "f3_score": 25.5, "tpr": 0.2375, "fpr": 0.2727, "youden_j": -0.0352, "cvss_coverage": 1.0, "cvss_tp_weight": 142.6, "cvss_fp_weight": 57.0, "cvss_fn_weight": 399.5, "cvss_precision": 0.7144, "cvss_recall": 0.2631, "cvss_f3": 0.2808, "cvss_f3_score": 28.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 8, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "high": { "tp": 5, "fp": 0, "fn": 22, "recall": 0.1852 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 22, "recall": 0.2903 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 69, "fp": 61, "fn": 11, "tn": 13, "ns": 0, "ns_gt": 0, "precision": 0.5308, "recall": 0.8625, "f1": 0.6571, "f2": 0.7667, "f2_score": 76.7, "f3": 0.8118, "f3_score": 81.2, "tpr": 0.8625, "fpr": 0.8243, "youden_j": 0.0382, "cvss_coverage": 1.0, "cvss_tp_weight": 468.3, "cvss_fp_weight": 481.0, "cvss_fn_weight": 73.8, "cvss_precision": 0.4933, "cvss_recall": 0.8639, "cvss_f3": 0.8035, "cvss_f3_score": 80.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 1, "fn": 0, "precision": 0.9412, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 1, "fn": 0, "precision": 0.8889, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 6, "fp": 1, "fn": 7, "precision": 0.8571, "recall": 0.4615 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 20, "fp": 2, "fn": 7, "recall": 0.7407 }, "low": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 30, "fp": 1, "fn": 1, "recall": 0.9677 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/main.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/gen_templates.sh", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-335" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-016", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-003", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-030", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 79, "fp": 9, "fn": 1, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8977, "recall": 0.9875, "f1": 0.9405, "f2": 0.9681, "f2_score": 96.8, "f3": 0.9777, "f3_score": 97.8, "tpr": 0.9875, "fpr": 0.36, "youden_j": 0.6275, "cvss_coverage": 1.0, "cvss_tp_weight": 532.3, "cvss_fp_weight": 69.5, "cvss_fn_weight": 9.8, "cvss_precision": 0.8845, "cvss_recall": 0.9819, "cvss_f3": 0.9712, "cvss_f3_score": 97.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 13, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 27, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 31, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-023", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-024", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-025", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-026", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-028", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-030", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 31, "fp": 14, "fn": 49, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.6889, "recall": 0.3875, "f1": 0.496, "f2": 0.4247, "f2_score": 42.5, "f3": 0.4052, "f3_score": 40.5, "tpr": 0.3875, "fpr": 0.4667, "youden_j": -0.0792, "cvss_coverage": 1.0, "cvss_tp_weight": 221.9, "cvss_fp_weight": 93.5, "cvss_fn_weight": 320.2, "cvss_precision": 0.7036, "cvss_recall": 0.4093, "cvss_f3": 0.4272, "cvss_f3_score": 42.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "denial_of_service": { "label": "Denial of Service", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "critical": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "high": { "tp": 8, "fp": 0, "fn": 19, "recall": 0.2963 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 17, "fp": 0, "fn": 14, "recall": 0.5484 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 69, "fp": 63, "fn": 11, "tn": 13, "ns": 0, "ns_gt": 0, "precision": 0.5227, "recall": 0.8625, "f1": 0.6509, "f2": 0.7633, "f2_score": 76.3, "f3": 0.8099, "f3_score": 81.0, "tpr": 0.8625, "fpr": 0.8289, "youden_j": 0.0336, "cvss_coverage": 1.0, "cvss_tp_weight": 468.3, "cvss_fp_weight": 492.0, "cvss_fn_weight": 73.8, "cvss_precision": 0.4877, "cvss_recall": 0.8639, "cvss_f3": 0.802, "cvss_f3_score": 80.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 16, "fp": 1, "fn": 0, "precision": 0.9412, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 1, "fn": 0, "precision": 0.8889, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 6, "fp": 1, "fn": 7, "precision": 0.8571, "recall": 0.4615 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 20, "fp": 2, "fn": 7, "recall": 0.7407 }, "low": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 30, "fp": 1, "fn": 1, "recall": 0.9677 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": ".github/workflows/main.yml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/gen_templates.sh", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-335" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-055", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-056", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-057", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-016", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-060", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-061", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-063", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-064", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-065", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-066", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-068", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-069", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-071", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-072", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-073", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-003", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-030", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulnpy-076", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 44, "fp": 6, "fn": 36, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.8847, "recall": 0.55, "f1": 0.6752, "f2": 0.5937, "f2_score": 59.4, "f3": 0.571, "f3_score": 57.1, "tpr": 0.55, "fpr": 0.2611, "youden_j": 0.2889, "cvss_coverage": 1.0, "cvss_tp_weight": 321.1, "cvss_fp_weight": 32.5, "cvss_fn_weight": 221.0, "cvss_precision": 0.9099, "cvss_recall": 0.5924, "cvss_f3": 0.6129, "cvss_f3_score": 61.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 5, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3846 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 9, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.75 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "high": { "tp": 18, "fp": 0, "fn": 9, "recall": 0.6667 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 18, "fp": 0, "fn": 13, "recall": 0.5806 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-029", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-059", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-062", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-067", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-070", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 48, "fp": 49, "fn": 32, "tn": 15, "ns": 0, "ns_gt": 0, "precision": 0.4948, "recall": 0.6, "f1": 0.5424, "f2": 0.5755, "f2_score": 57.6, "f3": 0.5875, "f3_score": 58.8, "tpr": 0.6, "fpr": 0.7656, "youden_j": -0.1656, "cvss_coverage": 1.0, "cvss_tp_weight": 344.1, "cvss_fp_weight": 278.7, "cvss_fn_weight": 198.0, "cvss_precision": 0.5525, "cvss_recall": 0.6348, "cvss_f3": 0.6254, "cvss_f3_score": 62.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 8, "fp": 1, "fn": 0, "precision": 0.8889, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 1, "fn": 12, "recall": 0.5556 }, "low": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-017", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/templates/jinja/xss.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/wsgi_app.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulnpy-074", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-525" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/django_asgi_app.py", "cwe": "CWE-453" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/fastapi_app.py", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/quart_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/bottle_app.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 49, "fp": 6, "fn": 31, "tn": 14, "ns": 0, "ns_gt": 0, "precision": 0.8909, "recall": 0.6125, "f1": 0.7259, "f2": 0.6533, "f2_score": 65.3, "f3": 0.6323, "f3_score": 63.2, "tpr": 0.6125, "fpr": 0.3, "youden_j": 0.3125, "cvss_coverage": 1.0, "cvss_tp_weight": 350.4, "cvss_fp_weight": 28.4, "cvss_fn_weight": 191.7, "cvss_precision": 0.925, "cvss_recall": 0.6464, "cvss_f3": 0.6664, "cvss_f3_score": 66.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 7, "fp": 1, "fn": 1, "precision": 0.875, "recall": 0.875 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 1, "fn": 0, "precision": 0.75, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 8, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6154 }, "xpath_injection": { "label": "XPath Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "xxe": { "label": "XML External Entities", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "high": { "tp": 21, "fp": 2, "fn": 6, "recall": 0.7778 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 15, "fp": 0, "fn": 16, "recall": 0.4839 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-009", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-010", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-011", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-012", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-013", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-014", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-015", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-016", "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-018", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-019", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-020", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-021", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-022", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-023", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-025", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-027", "file": "src/vulnpy/trigger/ssrf.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulnpy-040", "file": "src/vulnpy/flask/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-043", "file": "src/vulnpy/falcon/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-044", "file": "src/vulnpy/falcon/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-047", "file": "src/vulnpy/bottle/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-046", "file": "src/vulnpy/pyramid/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-049", "file": "src/vulnpy/quart/blueprint.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-048", "file": "src/vulnpy/aiohttp/vulnerable_routes.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-050", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-037", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-038", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-039", "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vulnpy-034", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-035", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vulnpy-036", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-058", "file": "src/vulnpy/trigger/redos.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-053", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-054", "file": "src/vulnpy/trigger/rand.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "vulnpy-075", "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/wsgi/app.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-001", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/xxe.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-007", "file": "src/vulnpy/common/templating.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "rowan": { "scanner": "rowan", "tp": 13, "fp": 16, "fn": 67, "tn": 13, "ns": 0, "ns_gt": 0, "precision": 0.4483, "recall": 0.1625, "f1": 0.2385, "f2": 0.1862, "f2_score": 18.6, "f3": 0.1736, "f3_score": 17.4, "tpr": 0.1625, "fpr": 0.5517, "youden_j": -0.3892, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 44.5, "cvss_fn_weight": 431.4, "cvss_precision": 0.7133, "cvss_recall": 0.2042, "cvss_f3": 0.2199, "cvss_f3_score": 22.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 3, "fp": 1, "fn": 1, "precision": 0.75, "recall": 0.75 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 2, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 10, "fp": 1, "fn": 2, "recall": 0.8333 }, "high": { "tp": 0, "fp": 2, "fn": 27, "recall": 0.0 }, "low": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 1, "fp": 0, "fn": 30, "recall": 0.0323 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-013", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-014", "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-079", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-080", "file": "apps/falcon_app.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/falcon_app.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/trigger/test_unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-002", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-052", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vulnpy-fp-011", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/pt.py", "cwe": "CWE-409" }, { "classification": "TP", "ground_truth_id": "vulnpy-033", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/xpath.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/trigger/test_unsafe_code_exec.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-041", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-042", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-047", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" } ] }, "semgrep": { "scanner": "semgrep", "tp": 13, "fp": 22, "fn": 67, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 0.3714, "recall": 0.1625, "f1": 0.2261, "f2": 0.1831, "f2_score": 18.3, "f3": 0.1722, "f3_score": 17.2, "tpr": 0.1625, "fpr": 0.5789, "youden_j": -0.4164, "cvss_coverage": 1.0, "cvss_tp_weight": 109.1, "cvss_fp_weight": 150.8, "cvss_fn_weight": 433.0, "cvss_precision": 0.4198, "cvss_recall": 0.2013, "cvss_f3": 0.2123, "cvss_f3_score": 21.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "high": { "tp": 3, "fp": 0, "fn": 24, "recall": 0.1111 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 2, "fp": 0, "fn": 29, "recall": 0.0645 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "TP", "ground_truth_id": "vulnpy-078", "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/flask_app.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/cmdi.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/deserialization.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/fragments/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/fragments/parameter_pollution.frag.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/hash.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/home.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/parameter_pollution.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/parameter_pollution.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/pt.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/rand.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/redos.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/sqli.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/ssrf.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/unsafe_code_exec.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/xpath.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/xss.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/templates/xxe.html", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-003", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-004", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-005", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-006", "file": "src/vulnpy/trigger/deserialization.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulnpy-051", "file": "src/vulnpy/trigger/hash.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulnpy-007", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-008", "file": "src/vulnpy/trigger/sqli.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulnpy-031", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vulnpy-032", "file": "src/vulnpy/trigger/unsafe_code_exec.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/vulnpy/trigger/util.py", "cwe": "CWE-706" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-045", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-047", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-077", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 0, "fn": 75, "tn": 16, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0625, "f1": 0.1176, "f2": 0.0769, "f2_score": 7.7, "f3": 0.069, "f3_score": 6.9, "tpr": 0.0625, "fpr": 0.0, "youden_j": 0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 37.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 504.2, "cvss_precision": 1.0, "cvss_recall": 0.0699, "cvss_f3": 0.0771, "cvss_f3_score": 7.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 13, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "high": { "tp": 0, "fp": 0, "fn": 27, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 28, "recall": 0.0968 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulnpy-077", "file": "apps/fastapi_app.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulnpy-041", "file": "src/vulnpy/django/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-042", "file": "src/vulnpy/django/vulnerable_asgi.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-045", "file": "src/vulnpy/fastapi/vulnerable.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulnpy-001", "file": "src/vulnpy/trigger/cmdi.py", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-002", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-003", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-004", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-005", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-006", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vulnpy-007", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-008", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-009", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulnpy-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-011", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulnpy-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-021", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-025", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-028", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-030", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vulnpy-031", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-032", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-033", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vulnpy-034", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-035", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vulnpy-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-038", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vulnpy-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-043", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-046", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-047", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-048", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-049", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-050", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulnpy-051", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-052", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-053", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vulnpy-054", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-055", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-056", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-057", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulnpy-058", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-059", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-060", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-061", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-062", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-063", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-064", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-065", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-066", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-067", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-068", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-069", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-070", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-071", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-072", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-073", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-074", "file": null, "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "vulnpy-075", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-076", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulnpy-078", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-004", "file": null, "cwe": "CWE-643" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-005", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-007", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-008", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-009", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-010", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-011", "file": null, "cwe": "CWE-502" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-012", "file": null, "cwe": "CWE-94" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-013", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-014", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-015", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vulnpy-fp-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vulnpy-079", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulnpy-080", "file": null, "cwe": "CWE-78" } ] } }, "realvuln-vulpy": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 35, "fp": 19, "fn": 22, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6481, "recall": 0.614, "f1": 0.6306, "f2": 0.6206, "f2_score": 62.1, "f3": 0.6173, "f3_score": 61.7, "tpr": 0.614, "fpr": 0.76, "youden_j": -0.146, "cvss_coverage": 1.0, "cvss_tp_weight": 222.9, "cvss_fp_weight": 107.8, "cvss_fn_weight": 120.9, "cvss_precision": 0.674, "cvss_recall": 0.6483, "cvss_f3": 0.6508, "cvss_f3_score": 65.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.5417 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 21, "fp": 0, "fn": 9, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-036", "file": "bad/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 14, "fn": 41, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.2807, "f1": 0.3678, "f2": 0.3101, "f2_score": 31.0, "f3": 0.2947, "f3_score": 29.5, "tpr": 0.2807, "fpr": 0.7, "youden_j": -0.4193, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 70.6, "cvss_fn_weight": 247.0, "cvss_precision": 0.5782, "cvss_recall": 0.2816, "cvss_f3": 0.2968, "cvss_f3_score": 29.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 8, "fp": 0, "fn": 22, "recall": 0.2667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-008", "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 20, "fp": 3, "fn": 37, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8761, "recall": 0.3567, "f1": 0.5062, "f2": 0.4044, "f2_score": 40.4, "f3": 0.3791, "f3_score": 37.9, "tpr": 0.3567, "fpr": 0.2825, "youden_j": 0.0743, "cvss_coverage": 1.0, "cvss_tp_weight": 145.0, "cvss_fp_weight": 14.8, "cvss_fn_weight": 198.8, "cvss_precision": 0.9013, "cvss_recall": 0.4217, "cvss_f3": 0.4453, "cvss_f3_score": 44.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 22, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-008", "file": "bad/libuser.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 23, "fp": 6, "fn": 34, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7931, "recall": 0.4035, "f1": 0.5349, "f2": 0.4475, "f2_score": 44.7, "f3": 0.4244, "f3_score": 42.4, "tpr": 0.4035, "fpr": 0.5, "youden_j": -0.0965, "cvss_coverage": 1.0, "cvss_tp_weight": 151.5, "cvss_fp_weight": 37.7, "cvss_fn_weight": 192.3, "cvss_precision": 0.8008, "cvss_recall": 0.4407, "cvss_f3": 0.4614, "cvss_f3_score": 46.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 }, "medium": { "tp": 12, "fp": 0, "fn": 18, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-033", "file": "bad/libapi.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rsa-keygen.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 31, "fp": 3, "fn": 26, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9118, "recall": 0.5439, "f1": 0.6813, "f2": 0.5916, "f2_score": 59.2, "f3": 0.5667, "f3_score": 56.7, "tpr": 0.5439, "fpr": 0.3333, "youden_j": 0.2105, "cvss_coverage": 1.0, "cvss_tp_weight": 191.6, "cvss_fp_weight": 18.8, "cvss_fn_weight": 152.2, "cvss_precision": 0.9104, "cvss_recall": 0.5573, "cvss_f3": 0.5798, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.5417 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 20, "fp": 0, "fn": 10, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-025", "file": "good/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 1, "fn": 48, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.1579, "f1": 0.2687, "f2": 0.1891, "f2_score": 18.9, "f3": 0.1721, "f3_score": 17.2, "tpr": 0.1579, "fpr": 0.1429, "youden_j": 0.015, "cvss_coverage": 1.0, "cvss_tp_weight": 64.1, "cvss_fp_weight": 6.3, "cvss_fn_weight": 279.7, "cvss_precision": 0.9107, "cvss_recall": 0.1864, "cvss_f3": 0.2026, "cvss_f3_score": 20.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.0417 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 25, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-025", "file": "good/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 2, "fn": 50, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.1228, "f1": 0.2121, "f2": 0.1477, "f2_score": 14.8, "f3": 0.1341, "f3_score": 13.4, "tpr": 0.1228, "fpr": 0.25, "youden_j": -0.1272, "cvss_coverage": 1.0, "cvss_tp_weight": 54.2, "cvss_fp_weight": 12.6, "cvss_fn_weight": 289.6, "cvss_precision": 0.8118, "cvss_recall": 0.1576, "cvss_f3": 0.1715, "cvss_f3_score": 17.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.0417 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 2, "fp": 0, "fn": 28, "recall": 0.0667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 11, "fp": 5, "fn": 46, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4777, "recall": 0.193, "f1": 0.2717, "f2": 0.2181, "f2_score": 21.8, "f3": 0.2048, "f3_score": 20.5, "tpr": 0.193, "fpr": 0.3417, "youden_j": -0.1487, "cvss_coverage": 1.0, "cvss_tp_weight": 72.7, "cvss_fp_weight": 27.4, "cvss_fn_weight": 271.1, "cvss_precision": 0.4914, "cvss_recall": 0.2115, "cvss_f3": 0.2239, "cvss_f3_score": 22.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 8, "fp": 0, "fn": 22, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 18, "fp": 17, "fn": 39, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5374, "recall": 0.31, "f1": 0.3803, "f2": 0.3336, "f2_score": 33.4, "f3": 0.3212, "f3_score": 32.1, "tpr": 0.31, "fpr": 0.6954, "youden_j": -0.3854, "cvss_coverage": 1.0, "cvss_tp_weight": 110.1, "cvss_fp_weight": 87.7, "cvss_fn_weight": 233.7, "cvss_precision": 0.5846, "cvss_recall": 0.3202, "cvss_f3": 0.3335, "cvss_f3_score": 33.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.1429 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 13, "fp": 0, "fn": 17, "recall": 0.4333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-799" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 29, "fp": 22, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5686, "recall": 0.5088, "f1": 0.537, "f2": 0.5197, "f2_score": 52.0, "f3": 0.5142, "f3_score": 51.4, "tpr": 0.5088, "fpr": 0.7857, "youden_j": -0.2769, "cvss_coverage": 1.0, "cvss_tp_weight": 173.1, "cvss_fp_weight": 132.4, "cvss_fn_weight": 170.7, "cvss_precision": 0.5666, "cvss_recall": 0.5035, "cvss_f3": 0.5092, "cvss_f3_score": 50.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 18, "fp": 0, "fn": 12, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-377" }, { "classification": "TP", "ground_truth_id": "vulpy-033", "file": "bad/libapi.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 20, "fp": 4, "fn": 37, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8587, "recall": 0.3509, "f1": 0.4901, "f2": 0.3953, "f2_score": 39.5, "f3": 0.3717, "f3_score": 37.2, "tpr": 0.3509, "fpr": 0.3476, "youden_j": 0.0032, "cvss_coverage": 1.0, "cvss_tp_weight": 128.6, "cvss_fp_weight": 19.2, "cvss_fn_weight": 215.2, "cvss_precision": 0.877, "cvss_recall": 0.3741, "cvss_f3": 0.3962, "cvss_f3_score": 39.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 12, "fp": 0, "fn": 18, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 10, "fp": 1, "fn": 47, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.1754, "f1": 0.2941, "f2": 0.2092, "f2_score": 20.9, "f3": 0.1908, "f3_score": 19.1, "tpr": 0.1754, "fpr": 0.1429, "youden_j": 0.0326, "cvss_coverage": 1.0, "cvss_tp_weight": 69.8, "cvss_fp_weight": 6.3, "cvss_fn_weight": 274.0, "cvss_precision": 0.9174, "cvss_recall": 0.203, "cvss_f3": 0.2202, "cvss_f3_score": 22.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 24, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 18, "fn": 38, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5135, "recall": 0.3333, "f1": 0.4043, "f2": 0.3585, "f2_score": 35.8, "f3": 0.3455, "f3_score": 34.5, "tpr": 0.3333, "fpr": 0.75, "youden_j": -0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 122.0, "cvss_fp_weight": 84.2, "cvss_fn_weight": 221.8, "cvss_precision": 0.5917, "cvss_recall": 0.3549, "cvss_f3": 0.3697, "cvss_f3_score": 37.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 7, "fp": 0, "fn": 23, "recall": 0.2333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/csp.txt", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-308" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 2, "fn": 42, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.2632, "f1": 0.4054, "f2": 0.3061, "f2_score": 30.6, "f3": 0.283, "f3_score": 28.3, "tpr": 0.2632, "fpr": 0.25, "youden_j": 0.0132, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 12.6, "cvss_fn_weight": 248.6, "cvss_precision": 0.8834, "cvss_recall": 0.2769, "cvss_f3": 0.2973, "cvss_f3_score": 29.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 9, "fp": 0, "fn": 21, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 31, "fp": 24, "fn": 26, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5636, "recall": 0.5439, "f1": 0.5536, "f2": 0.5477, "f2_score": 54.8, "f3": 0.5458, "f3_score": 54.6, "tpr": 0.5439, "fpr": 0.8, "youden_j": -0.2561, "cvss_coverage": 1.0, "cvss_tp_weight": 182.4, "cvss_fp_weight": 133.4, "cvss_fn_weight": 161.4, "cvss_precision": 0.5775, "cvss_recall": 0.5305, "cvss_f3": 0.5349, "cvss_f3_score": 53.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.5417 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 19, "fp": 0, "fn": 11, "recall": 0.6333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-694" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-379" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "good/csp.txt", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-636" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rsa-keygen.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/ca-create.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-377" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 29, "fp": 17, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6304, "recall": 0.5088, "f1": 0.5631, "f2": 0.5292, "f2_score": 52.9, "f3": 0.5188, "f3_score": 51.9, "tpr": 0.5088, "fpr": 0.7391, "youden_j": -0.2304, "cvss_coverage": 1.0, "cvss_tp_weight": 170.5, "cvss_fp_weight": 83.7, "cvss_fn_weight": 173.3, "cvss_precision": 0.6708, "cvss_recall": 0.4959, "cvss_f3": 0.5092, "cvss_f3_score": 50.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.2857 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 }, "medium": { "tp": 19, "fp": 0, "fn": 11, "recall": 0.6333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-155" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-033", "file": "bad/libapi.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 15, "fp": 6, "fn": 42, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7091, "recall": 0.2573, "f1": 0.3775, "f2": 0.2948, "f2_score": 29.5, "f3": 0.2748, "f3_score": 27.5, "tpr": 0.2573, "fpr": 0.5053, "youden_j": -0.248, "cvss_coverage": 1.0, "cvss_tp_weight": 107.8, "cvss_fp_weight": 31.9, "cvss_fn_weight": 236.0, "cvss_precision": 0.7711, "cvss_recall": 0.3136, "cvss_f3": 0.3333, "cvss_f3_score": 33.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 1, "fn": 12, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 19, "recall": 0.3667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": "vulpy-fp-006", "file": "bad/brute.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 24, "fp": 3, "fn": 33, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8662, "recall": 0.4152, "f1": 0.56, "f2": 0.463, "f2_score": 46.3, "f3": 0.4378, "f3_score": 43.8, "tpr": 0.4152, "fpr": 0.3393, "youden_j": 0.0759, "cvss_coverage": 1.0, "cvss_tp_weight": 156.1, "cvss_fp_weight": 15.1, "cvss_fn_weight": 187.7, "cvss_precision": 0.9053, "cvss_recall": 0.454, "cvss_f3": 0.4773, "cvss_f3_score": 47.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 15, "fp": 0, "fn": 15, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": "vulpy-fp-006", "file": "bad/brute.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-025", "file": "good/templates/messages.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 26, "fp": 8, "fn": 31, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7653, "recall": 0.4561, "f1": 0.5695, "f2": 0.4953, "f2_score": 49.5, "f3": 0.4749, "f3_score": 47.5, "tpr": 0.4561, "fpr": 0.5515, "youden_j": -0.0954, "cvss_coverage": 1.0, "cvss_tp_weight": 167.4, "cvss_fp_weight": 48.5, "cvss_fn_weight": 176.4, "cvss_precision": 0.7868, "cvss_recall": 0.487, "cvss_f3": 0.5055, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 16, "fp": 0, "fn": 14, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-031", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 0, "fp": 0, "fn": 57, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 343.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 24, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 30, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vulpy-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 6, "fn": 42, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.2632, "f1": 0.3846, "f2": 0.3012, "f2_score": 30.1, "f3": 0.2809, "f3_score": 28.1, "tpr": 0.2632, "fpr": 0.5, "youden_j": -0.2368, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 39.5, "cvss_fn_weight": 248.1, "cvss_precision": 0.7078, "cvss_recall": 0.2784, "cvss_f3": 0.2963, "cvss_f3_score": 29.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 }, "medium": { "tp": 7, "fp": 0, "fn": 23, "recall": 0.2333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 43, "fp": 69, "fn": 14, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3839, "recall": 0.7544, "f1": 0.5089, "f2": 0.6324, "f2_score": 63.2, "f3": 0.688, "f3_score": 68.8, "tpr": 0.7544, "fpr": 0.92, "youden_j": -0.1656, "cvss_coverage": 1.0, "cvss_tp_weight": 252.3, "cvss_fp_weight": 482.0, "cvss_fn_weight": 91.5, "cvss_precision": 0.3436, "cvss_recall": 0.7339, "cvss_f3": 0.659, "cvss_f3_score": 65.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 24, "fp": 0, "fn": 6, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-031", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/aes-encrypt.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-036", "file": "bad/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vulpy-008", "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_welcome1.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-051", "file": "good/libposts.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-050", "file": "good/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/rsa-keygen.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/ca-create.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/csp.txt", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "good/csp.txt", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vulpy-054", "file": "utils/skey.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-045", "file": "good/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-440" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-308" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libposts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 23, "fp": 35, "fn": 34, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3966, "recall": 0.4035, "f1": 0.4, "f2": 0.4021, "f2_score": 40.2, "f3": 0.4028, "f3_score": 40.3, "tpr": 0.4035, "fpr": 0.8537, "youden_j": -0.4501, "cvss_coverage": 1.0, "cvss_tp_weight": 138.1, "cvss_fp_weight": 261.5, "cvss_fn_weight": 205.7, "cvss_precision": 0.3456, "cvss_recall": 0.4017, "cvss_f3": 0.3953, "cvss_f3_score": 39.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.4286 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 14, "fp": 0, "fn": 16, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-41" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-013", "file": "bad/mod_mfa.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-036", "file": "bad/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-288" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-324" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 5, "fp": 4, "fn": 52, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.0877, "f1": 0.1515, "f2": 0.1055, "f2_score": 10.5, "f3": 0.0958, "f3_score": 9.6, "tpr": 0.0877, "fpr": 0.4, "youden_j": -0.3123, "cvss_coverage": 1.0, "cvss_tp_weight": 31.7, "cvss_fp_weight": 29.5, "cvss_fn_weight": 312.1, "cvss_precision": 0.518, "cvss_recall": 0.0922, "cvss_f3": 0.1005, "cvss_f3_score": 10.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 28, "recall": 0.0667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "vulpy-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 46, "fp": 60, "fn": 11, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.434, "recall": 0.807, "f1": 0.5644, "f2": 0.6886, "f2_score": 68.9, "f3": 0.7431, "f3_score": 74.3, "tpr": 0.807, "fpr": 0.9091, "youden_j": -0.1021, "cvss_coverage": 1.0, "cvss_tp_weight": 278.9, "cvss_fp_weight": 439.0, "cvss_fn_weight": 64.9, "cvss_precision": 0.3885, "cvss_recall": 0.8112, "cvss_f3": 0.7316, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 27, "fp": 0, "fn": 3, "recall": 0.9 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/csp.txt", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-032", "file": "bad/libapi.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-008", "file": "bad/libuser.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/posts.view.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.chpasswd.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.create.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/csp.txt", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-051", "file": "good/libposts.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-050", "file": "good/libuser.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-012", "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vulpy-025", "file": "good/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/mfa.enable.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-054", "file": "utils/skey.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 52, "fp": 11, "fn": 5, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8254, "recall": 0.9123, "f1": 0.8667, "f2": 0.8935, "f2_score": 89.3, "f3": 0.9028, "f3_score": 90.3, "tpr": 0.9123, "fpr": 0.6471, "youden_j": 0.2652, "cvss_coverage": 1.0, "cvss_tp_weight": 310.4, "cvss_fp_weight": 70.5, "cvss_fn_weight": 33.4, "cvss_precision": 0.8149, "cvss_recall": 0.9029, "cvss_f3": 0.8932, "cvss_f3_score": 89.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 22, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9167 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 7, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "low": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 27, "fp": 0, "fn": 3, "recall": 0.9 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-033", "file": "bad/libapi.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-031", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-036", "file": "bad/mod_api.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-011", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-049", "file": "good/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-051", "file": "good/libposts.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-050", "file": "good/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-045", "file": "good/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-013", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-012", "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/generate_bad_passwords.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/httpbrute.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-054", "file": "utils/skey.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 29, "fp": 17, "fn": 28, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6304, "recall": 0.5088, "f1": 0.5631, "f2": 0.5292, "f2_score": 52.9, "f3": 0.5188, "f3_score": 51.9, "tpr": 0.5088, "fpr": 0.7391, "youden_j": -0.2304, "cvss_coverage": 1.0, "cvss_tp_weight": 170.6, "cvss_fp_weight": 113.0, "cvss_fn_weight": 173.2, "cvss_precision": 0.6016, "cvss_recall": 0.4962, "cvss_f3": 0.5051, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5714 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 14, "fp": 0, "fn": 16, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-050", "file": "good/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-045", "file": "good/mod_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-012", "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-051", "file": "good/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 47, "fp": 70, "fn": 10, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.4017, "recall": 0.8246, "f1": 0.5402, "f2": 0.6812, "f2_score": 68.1, "f3": 0.746, "f3_score": 74.6, "tpr": 0.8246, "fpr": 0.9211, "youden_j": -0.0965, "cvss_coverage": 1.0, "cvss_tp_weight": 282.6, "cvss_fp_weight": 513.0, "cvss_fn_weight": 61.2, "cvss_precision": 0.3552, "cvss_recall": 0.822, "cvss_f3": 0.7265, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7917 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.7143 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 27, "fp": 0, "fn": 3, "recall": 0.9 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/api_list.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/csp.txt", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-021", "file": "bad/db.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-007", "file": "bad/db_init.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-032", "file": "bad/libapi.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-052", "file": "bad/libmfa.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libmfa.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libposts.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-034", "file": "bad/libposts.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-018", "file": "bad/libuser.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vulpy-008", "file": "bad/libuser.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-037", "file": "bad/mod_api.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_api.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-035", "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vulpy-015", "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-005", "file": "bad/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/mfa.enable.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/posts.view.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.chpasswd.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.create.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/csp.txt", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vulpy-042", "file": "good/db_init.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libmfa.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-051", "file": "good/libposts.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-050", "file": "good/libuser.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_api.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/mod_posts.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-046", "file": "good/mod_user.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-012", "file": "good/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vulpy-025", "file": "good/templates/messages.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/mfa.enable.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/mfa.enable.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-054", "file": "utils/skey.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 19, "fp": 3, "fn": 38, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.8636, "recall": 0.3333, "f1": 0.481, "f2": 0.38, "f2_score": 38.0, "f3": 0.3551, "f3_score": 35.5, "tpr": 0.3333, "fpr": 0.3333, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 132.3, "cvss_fp_weight": 13.1, "cvss_fn_weight": 211.5, "cvss_precision": 0.9101, "cvss_recall": 0.3848, "cvss_f3": 0.4084, "cvss_f3_score": 40.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 12, "fp": 0, "fn": 18, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-006", "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vulpy-030", "file": "bad/mod_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-028", "file": "good/libsession.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-024", "file": "good/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 7, "fn": 46, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.193, "f1": 0.2933, "f2": 0.2236, "f2_score": 22.4, "f3": 0.2072, "f3_score": 20.7, "tpr": 0.193, "fpr": 0.5385, "youden_j": -0.3455, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 38.2, "cvss_fn_weight": 269.3, "cvss_precision": 0.6611, "cvss_recall": 0.2167, "cvss_f3": 0.2323, "cvss_f3_score": 23.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 4, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 7, "fp": 0, "fn": 23, "recall": 0.2333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-318" }, { "classification": "TP", "ground_truth_id": "vulpy-017", "file": "bad/libuser.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/mod_user.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-004", "file": "bad/templates/posts.view.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vulpy-012", "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libapi.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-289" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/mod_mfa.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-754" }, { "classification": "FN", "ground_truth_id": "vulpy-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "rowan": { "scanner": "rowan", "tp": 14, "fp": 38, "fn": 43, "tn": 5, "ns": 0, "ns_gt": 0, "precision": 0.2692, "recall": 0.2456, "f1": 0.2569, "f2": 0.25, "f2_score": 25.0, "f3": 0.2478, "f3_score": 24.8, "tpr": 0.2456, "fpr": 0.8837, "youden_j": -0.6381, "cvss_coverage": 1.0, "cvss_tp_weight": 96.0, "cvss_fp_weight": 180.5, "cvss_fn_weight": 247.8, "cvss_precision": 0.3472, "cvss_recall": 0.2792, "cvss_f3": 0.2848, "cvss_f3_score": 28.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 13, "recall": 0.1875 }, "low": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 9, "fp": 0, "fn": 21, "recall": 0.3 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/brute.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/brute.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_posts.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vulpy-048", "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_mfa.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_posts.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_welcome1.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vulpy-016", "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libsession.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": "vulpy-fp-006", "file": "bad/brute.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vulpy-011", "file": "bad/libapi.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/mod_user.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libsession.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "good/mod_user.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/crack-cvv.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vulpy-039", "file": "utils/skey.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/skey.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "utils/skey.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "semgrep": { "scanner": "semgrep", "tp": 16, "fp": 29, "fn": 41, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.3556, "recall": 0.2807, "f1": 0.3137, "f2": 0.293, "f2_score": 29.3, "f3": 0.2867, "f3_score": 28.7, "tpr": 0.2807, "fpr": 0.8286, "youden_j": -0.5479, "cvss_coverage": 1.0, "cvss_tp_weight": 101.6, "cvss_fp_weight": 159.1, "cvss_fn_weight": 242.2, "cvss_precision": 0.3898, "cvss_recall": 0.2955, "cvss_f3": 0.3028, "cvss_f3_score": 30.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 10, "fp": 0, "fn": 20, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "bad/api_list.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/api_post.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vulpy-020", "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-019", "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/db_init.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-001", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-002", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vulpy-003", "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/csp.html", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vulpy-038", "file": "bad/templates/mfa.enable.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-029", "file": "bad/templates/posts.view.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-014", "file": "bad/templates/user.chpasswd.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/user.login.mfa.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/templates/welcome.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulpy-023", "file": "bad/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulpy-009", "file": "bad/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/httpbrute.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libapi.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vulpy-026", "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/libuser.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/csp.html", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vulpy-047", "file": "good/templates/mfa.enable.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-014", "file": "good/templates/posts.view.html", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vulpy-fp-012", "file": "good/templates/user.chpasswd.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/user.create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/user.login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/user.login.mfa.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/templates/welcome.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulpy-043", "file": "good/vulpy-ssl.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vulpy-044", "file": "good/vulpy.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 4, "fn": 52, "tn": 6, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.0877, "f1": 0.1515, "f2": 0.1055, "f2_score": 10.5, "f3": 0.0958, "f3_score": 9.6, "tpr": 0.0877, "fpr": 0.4, "youden_j": -0.3123, "cvss_coverage": 1.0, "cvss_tp_weight": 29.5, "cvss_fp_weight": 38.0, "cvss_fn_weight": 314.3, "cvss_precision": 0.437, "cvss_recall": 0.0858, "cvss_f3": 0.0933, "cvss_f3_score": 9.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 24, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 7, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 15, "recall": 0.0625 }, "low": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 26, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vulpy-022", "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-010", "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "bad/vulpy.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-027", "file": "good/libapi.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-040", "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy-ssl.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vulpy-041", "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "good/vulpy.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-006", "file": null, "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "vulpy-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-008", "file": null, "cwe": "CWE-256" }, { "classification": "FN", "ground_truth_id": "vulpy-009", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-011", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vulpy-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vulpy-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vulpy-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vulpy-017", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vulpy-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-023", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vulpy-024", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vulpy-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vulpy-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vulpy-029", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-031", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vulpy-032", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vulpy-033", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-035", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-036", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vulpy-038", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-039", "file": null, "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vulpy-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vulpy-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-044", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vulpy-045", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-046", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vulpy-047", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-048", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vulpy-049", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vulpy-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-051", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vulpy-054", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-001", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-005", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vulpy-fp-006", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-011", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-012", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-013", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-fp-014", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vulpy-052", "file": null, "cwe": "CWE-200" } ] } }, "realvuln-xvna": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 0, "fp": 18, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 108.9, "cvss_fn_weight": 91.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "xvna/index.js", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-007", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-010", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "xvna-012", "file": null, "cwe": "CWE-79" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 4, "fp": 12, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.3333, "f1": 0.2857, "f2": 0.3125, "f2_score": 31.2, "f3": 0.3226, "f3_score": 32.3, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 30.9, "cvss_fp_weight": 55.9, "cvss_fn_weight": 60.7, "cvss_precision": 0.3559, "cvss_recall": 0.3373, "cvss_f3": 0.3391, "cvss_f3_score": 33.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 4, "fp": 9, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.3333, "f1": 0.32, "f2": 0.3279, "f2_score": 32.8, "f3": 0.3306, "f3_score": 33.1, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 30.9, "cvss_fp_weight": 47.3, "cvss_fn_weight": 60.7, "cvss_precision": 0.3951, "cvss_recall": 0.3373, "cvss_f3": 0.3423, "cvss_f3_score": 34.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 4, "fp": 15, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2105, "recall": 0.3333, "f1": 0.2581, "f2": 0.2985, "f2_score": 29.9, "f3": 0.315, "f3_score": 31.5, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 30.9, "cvss_fp_weight": 100.2, "cvss_fn_weight": 60.7, "cvss_precision": 0.2356, "cvss_recall": 0.3373, "cvss_f3": 0.3234, "cvss_f3_score": 32.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-547" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 7, "fp": 29, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1944, "recall": 0.5833, "f1": 0.2917, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4861, "f3_score": 48.6, "tpr": 0.5833, "fpr": 1.0, "youden_j": -0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 55.9, "cvss_fp_weight": 221.4, "cvss_fn_weight": 35.7, "cvss_precision": 0.2016, "cvss_recall": 0.6103, "cvss_f3": 0.5074, "cvss_f3_score": 50.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "xvna-011", "file": "index.js", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "xvna-008", "file": "index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/directives/ui-chatwindow.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/directives/ui-chatwindow.js", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/directives/ui-todowidget.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/directives/ui-todowidget.js", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "xvna-002", "file": "index.js", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 10, "fp": 14, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.8333, "f1": 0.5556, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7576, "f3_score": 75.8, "tpr": 0.8333, "fpr": 1.0, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 76.0, "cvss_fp_weight": 106.9, "cvss_fn_weight": 15.6, "cvss_precision": 0.4156, "cvss_recall": 0.8297, "cvss_f3": 0.7545, "cvss_f3_score": 75.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-001", "file": "index.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "xvna-002", "file": "index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "xvna-004", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "xvna-006", "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "xvna-008", "file": "index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "xvna-009", "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 6, "fp": 19, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.24, "recall": 0.5, "f1": 0.3243, "f2": 0.411, "f2_score": 41.1, "f3": 0.4511, "f3_score": 45.1, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 45.8, "cvss_fp_weight": 130.8, "cvss_fn_weight": 45.8, "cvss_precision": 0.2594, "cvss_recall": 0.5, "cvss_f3": 0.4576, "cvss_f3_score": 45.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/js/controllers/login.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "xvna-002", "file": "index.js", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "xvna-001", "file": "index.js", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "collection/login.json", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 10, "fp": 14, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.8333, "f1": 0.5556, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7576, "f3_score": 75.8, "tpr": 0.8333, "fpr": 1.0, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 76.0, "cvss_fp_weight": 106.9, "cvss_fn_weight": 15.6, "cvss_precision": 0.4156, "cvss_recall": 0.8297, "cvss_f3": 0.7545, "cvss_f3_score": 75.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "xvna-001", "file": "index.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "xvna-002", "file": "index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "xvna-004", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "xvna-006", "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "xvna-008", "file": "index.js", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "xvna-009", "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-011", "file": null, "cwe": "CWE-94" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 11, "fp": 30, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2683, "recall": 0.9167, "f1": 0.4151, "f2": 0.618, "f2_score": 61.8, "f3": 0.7383, "f3_score": 73.8, "tpr": 0.9167, "fpr": 1.0, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 85.8, "cvss_fp_weight": 229.0, "cvss_fn_weight": 5.8, "cvss_precision": 0.2726, "cvss_recall": 0.9367, "cvss_f3": 0.7532, "cvss_f3_score": 75.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "xvna-008", "file": "index.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "xvna-011", "file": "index.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "xvna-012", "file": "public/app/js/controllers/a7_xss_reflected.js", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/partials/a7_xss_reflected.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/partials/a8_insecure_deserialization.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "public/app/partials/eval.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "xvna-001", "file": "index.js", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "xvna-004", "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-005", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-010", "file": "index.js", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "xvna-002", "file": "index.js", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "public/bower_components/angular-ui-event/.travis.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/bower_components/angular-ui-indeterminate/.travis.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "public/users.xml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "xvna-006", "file": "index.js", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "xvna-009", "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 14, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.125, "recall": 0.1667, "f1": 0.1429, "f2": 0.1562, "f2_score": 15.6, "f3": 0.1613, "f3_score": 16.1, "tpr": 0.1667, "fpr": 1.0, "youden_j": -0.8333, "cvss_coverage": 1.0, "cvss_tp_weight": 19.6, "cvss_fp_weight": 78.3, "cvss_fn_weight": 72.0, "cvss_precision": 0.2001, "cvss_recall": 0.214, "cvss_f3": 0.2125, "cvss_f3_score": 21.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "xvna-007", "file": "index.js", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "xvna-011", "file": "index.js", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "index.js", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "xvna-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "xvna-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "xvna-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "xvna-004", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-005", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-006", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "xvna-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "xvna-010", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "xvna-012", "file": null, "cwe": "CWE-79" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v2-crm-saas-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 8, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7037, "recall": 0.6786, "f1": 0.6909, "f2": 0.6835, "f2_score": 68.3, "f3": 0.681, "f3_score": 68.1, "tpr": 0.6786, "fpr": 0.6667, "youden_j": 0.0119, "cvss_coverage": 1.0, "cvss_tp_weight": 109.8, "cvss_fp_weight": 35.8, "cvss_fn_weight": 51.4, "cvss_precision": 0.7543, "cvss_recall": 0.6811, "cvss_f3": 0.6878, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-333", "file": "crm_project/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/permissions.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 18, "fp": 10, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.6429, "f1": 0.6429, "f2": 0.6429, "f2_score": 64.3, "f3": 0.6429, "f3_score": 64.3, "tpr": 0.6429, "fpr": 0.7143, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 108.5, "cvss_fp_weight": 45.8, "cvss_fn_weight": 52.7, "cvss_precision": 0.703, "cvss_recall": 0.6731, "cvss_f3": 0.676, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.4286, "f1": 0.5333, "f2": 0.4651, "f2_score": 46.5, "f3": 0.4461, "f3_score": 44.6, "tpr": 0.4286, "fpr": 0.5556, "youden_j": -0.127, "cvss_coverage": 1.0, "cvss_tp_weight": 72.9, "cvss_fp_weight": 25.2, "cvss_fn_weight": 88.3, "cvss_precision": 0.7432, "cvss_recall": 0.4522, "cvss_f3": 0.4707, "cvss_f3_score": 47.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.4643, "f1": 0.5778, "f2": 0.5039, "f2_score": 50.4, "f3": 0.4833, "f3_score": 48.3, "tpr": 0.4643, "fpr": 0.5, "youden_j": -0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 77.2, "cvss_fp_weight": 15.6, "cvss_fn_weight": 84.0, "cvss_precision": 0.8318, "cvss_recall": 0.4789, "cvss_f3": 0.5001, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-359", "file": "crm_project/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 10, "fn": 10, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.6429, "f1": 0.6429, "f2": 0.6429, "f2_score": 64.3, "f3": 0.6429, "f3_score": 64.3, "tpr": 0.6429, "fpr": 0.8333, "youden_j": -0.1905, "cvss_coverage": 1.0, "cvss_tp_weight": 108.9, "cvss_fp_weight": 36.8, "cvss_fn_weight": 52.3, "cvss_precision": 0.7476, "cvss_recall": 0.6756, "cvss_f3": 0.6821, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 8, "fp": 2, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9111, "recall": 0.3571, "f1": 0.5126, "f2": 0.4064, "f2_score": 40.6, "f3": 0.3802, "f3_score": 38.0, "tpr": 0.3571, "fpr": 0.1778, "youden_j": 0.1794, "cvss_coverage": 1.0, "cvss_tp_weight": 61.4, "cvss_fp_weight": 5.0, "cvss_fn_weight": 99.8, "cvss_precision": 0.9253, "cvss_recall": 0.3811, "cvss_f3": 0.4049, "cvss_f3_score": 40.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 9, "fp": 0, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3214, "f1": 0.4865, "f2": 0.3719, "f2_score": 37.2, "f3": 0.3448, "f3_score": 34.5, "tpr": 0.3214, "fpr": 0.0, "youden_j": 0.3214, "cvss_coverage": 1.0, "cvss_tp_weight": 56.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 104.4, "cvss_precision": 1.0, "cvss_recall": 0.3524, "cvss_f3": 0.3768, "cvss_f3_score": 37.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 161.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 6, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2464, "recall": 0.2024, "f1": 0.2222, "f2": 0.2099, "f2_score": 21.0, "f3": 0.2061, "f3_score": 20.6, "tpr": 0.2024, "fpr": 0.2, "youden_j": 0.0024, "cvss_coverage": 1.0, "cvss_tp_weight": 34.9, "cvss_fp_weight": 5.5, "cvss_fn_weight": 126.3, "cvss_precision": 0.2876, "cvss_recall": 0.2163, "cvss_f3": 0.2218, "cvss_f3_score": 22.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-603" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 161.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 12, "fn": 11, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.6071, "f1": 0.5965, "f2": 0.6028, "f2_score": 60.3, "f3": 0.605, "f3_score": 60.5, "tpr": 0.6071, "fpr": 0.8571, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 102.5, "cvss_fp_weight": 42.3, "cvss_fn_weight": 58.7, "cvss_precision": 0.7079, "cvss_recall": 0.6359, "cvss_f3": 0.6424, "cvss_f3_score": 64.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 6, "fp": 2, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7369, "recall": 0.5, "f1": 0.5922, "f2": 0.5328, "f2_score": 53.3, "f3": 0.5158, "f3_score": 51.6, "tpr": 0.5, "fpr": 0.5519, "youden_j": -0.0518, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 17.6, "cvss_fn_weight": 70.6, "cvss_precision": 0.8367, "cvss_recall": 0.5621, "cvss_f3": 0.5806, "cvss_f3_score": 58.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 11, "fp": 4, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.3929, "f1": 0.5116, "f2": 0.4331, "f2_score": 43.3, "f3": 0.412, "f3_score": 41.2, "tpr": 0.3929, "fpr": 0.5714, "youden_j": -0.1786, "cvss_coverage": 1.0, "cvss_tp_weight": 70.7, "cvss_fp_weight": 15.6, "cvss_fn_weight": 90.5, "cvss_precision": 0.8191, "cvss_recall": 0.4386, "cvss_f3": 0.46, "cvss_f3_score": 46.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 4, "fp": 1, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 28, "fp": 4, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 1.0, "f1": 0.9333, "f2": 0.9722, "f2_score": 97.2, "f3": 0.9859, "f3_score": 98.6, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 161.2, "cvss_fp_weight": 20.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.8889, "cvss_recall": 1.0, "cvss_f3": 0.9877, "cvss_f3_score": 98.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-333", "file": "crm_project/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-359", "file": "crm_project/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/admin_panel/user_list.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": "crm/views/_helpers.py", "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5357, "f1": 0.625, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5515, "f3_score": 55.1, "tpr": 0.5357, "fpr": 0.5556, "youden_j": -0.0198, "cvss_coverage": 1.0, "cvss_tp_weight": 94.9, "cvss_fp_weight": 25.2, "cvss_fn_weight": 66.3, "cvss_precision": 0.7903, "cvss_recall": 0.5887, "cvss_f3": 0.6041, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 9, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6087, "recall": 0.5, "f1": 0.549, "f2": 0.5185, "f2_score": 51.9, "f3": 0.5091, "f3_score": 50.9, "tpr": 0.5, "fpr": 0.75, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 92.0, "cvss_fp_weight": 36.3, "cvss_fn_weight": 69.2, "cvss_precision": 0.7173, "cvss_recall": 0.5707, "cvss_f3": 0.5826, "cvss_f3_score": 58.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 4, "fp": 1, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/admin_panel/user_list.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/deals.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 4, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 1.0, "f1": 0.9333, "f2": 0.9722, "f2_score": 97.2, "f3": 0.9859, "f3_score": 98.6, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 161.2, "cvss_fp_weight": 15.6, "cvss_fn_weight": 0.0, "cvss_precision": 0.9117, "cvss_recall": 1.0, "cvss_f3": 0.9904, "cvss_f3_score": 99.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-333", "file": "crm_project/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-359", "file": "crm_project/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": "crm/views/_helpers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7508, "recall": 0.4821, "f1": 0.5867, "f2": 0.5192, "f2_score": 51.9, "f3": 0.5, "f3_score": 50.0, "tpr": 0.4821, "fpr": 0.5635, "youden_j": -0.0814, "cvss_coverage": 1.0, "cvss_tp_weight": 78.5, "cvss_fp_weight": 11.3, "cvss_fn_weight": 82.8, "cvss_precision": 0.8737, "cvss_recall": 0.4867, "cvss_f3": 0.5091, "cvss_f3_score": 50.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7761, "recall": 0.4524, "f1": 0.5701, "f2": 0.493, "f2_score": 49.3, "f3": 0.4718, "f3_score": 47.2, "tpr": 0.4524, "fpr": 0.5, "youden_j": -0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 83.5, "cvss_fp_weight": 12.4, "cvss_fn_weight": 77.7, "cvss_precision": 0.8708, "cvss_recall": 0.5178, "cvss_f3": 0.5395, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 8, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.634, "recall": 0.4643, "f1": 0.5352, "f2": 0.4901, "f2_score": 49.0, "f3": 0.4768, "f3_score": 47.7, "tpr": 0.4643, "fpr": 0.6657, "youden_j": -0.2014, "cvss_coverage": 1.0, "cvss_tp_weight": 84.9, "cvss_fp_weight": 25.0, "cvss_fn_weight": 76.3, "cvss_precision": 0.7749, "cvss_recall": 0.5267, "cvss_f3": 0.5441, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 1, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/deals/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5714, "f1": 0.6275, "f2": 0.5926, "f2_score": 59.3, "f3": 0.5818, "f3_score": 58.2, "tpr": 0.5714, "fpr": 0.6364, "youden_j": -0.0649, "cvss_coverage": 1.0, "cvss_tp_weight": 99.2, "cvss_fp_weight": 30.7, "cvss_fn_weight": 62.0, "cvss_precision": 0.7635, "cvss_recall": 0.6154, "cvss_f3": 0.6276, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 14, "fn": 13, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5172, "recall": 0.5357, "f1": 0.5263, "f2": 0.5319, "f2_score": 53.2, "f3": 0.5338, "f3_score": 53.4, "tpr": 0.5357, "fpr": 0.875, "youden_j": -0.3393, "cvss_coverage": 1.0, "cvss_tp_weight": 88.0, "cvss_fp_weight": 81.5, "cvss_fn_weight": 73.2, "cvss_precision": 0.5192, "cvss_recall": 0.5459, "cvss_f3": 0.5431, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 7, "fp": 2, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 14, "fp": 38, "fn": 14, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2692, "recall": 0.5, "f1": 0.35, "f2": 0.4268, "f2_score": 42.7, "f3": 0.4605, "f3_score": 46.1, "tpr": 0.5, "fpr": 0.95, "youden_j": -0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 77.2, "cvss_fp_weight": 234.0, "cvss_fn_weight": 84.0, "cvss_precision": 0.2481, "cvss_recall": 0.4789, "cvss_f3": 0.4381, "cvss_f3_score": 43.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 1, "fn": 9, "precision": 0.8889, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 8, "fp": 2, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-359", "file": "crm_project/partner_console.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-291" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/audit.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/customer_portal.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": "crm/models.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": "crm/views/escalations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/contacts.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 21, "fp": 29, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.42, "recall": 0.75, "f1": 0.5385, "f2": 0.6481, "f2_score": 64.8, "f3": 0.6954, "f3_score": 69.5, "tpr": 0.75, "fpr": 0.9062, "youden_j": -0.1562, "cvss_coverage": 1.0, "cvss_tp_weight": 124.4, "cvss_fp_weight": 216.5, "cvss_fn_weight": 36.8, "cvss_precision": 0.3649, "cvss_recall": 0.7717, "cvss_f3": 0.6943, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 9, "fp": 1, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/deals/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/audit.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/asgi.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/admin_panel.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/organizations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 2, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0714, "f1": 0.125, "f2": 0.0862, "f2_score": 8.6, "f3": 0.0781, "f3_score": 7.8, "tpr": 0.0714, "fpr": 0.3333, "youden_j": -0.2619, "cvss_coverage": 1.0, "cvss_tp_weight": 10.0, "cvss_fp_weight": 10.0, "cvss_fn_weight": 151.2, "cvss_precision": 0.5, "cvss_recall": 0.062, "cvss_f3": 0.068, "cvss_f3_score": 6.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 65, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2442, "recall": 0.75, "f1": 0.3684, "f2": 0.5303, "f2_score": 53.0, "f3": 0.6213, "f3_score": 62.1, "tpr": 0.75, "fpr": 0.9559, "youden_j": -0.2059, "cvss_coverage": 1.0, "cvss_tp_weight": 127.0, "cvss_fp_weight": 477.0, "cvss_fn_weight": 34.2, "cvss_precision": 0.2103, "cvss_recall": 0.7878, "cvss_f3": 0.6181, "cvss_f3_score": 61.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 9, "fp": 1, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/urls.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/admin_panel/user_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/deals/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/invite_accept.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_change_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 12, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6757, "recall": 0.8929, "f1": 0.7692, "f2": 0.8389, "f2_score": 83.9, "f3": 0.8651, "f3_score": 86.5, "tpr": 0.8929, "fpr": 0.8, "youden_j": 0.0929, "cvss_coverage": 1.0, "cvss_tp_weight": 141.8, "cvss_fp_weight": 86.0, "cvss_fn_weight": 19.4, "cvss_precision": 0.6225, "cvss_recall": 0.8797, "cvss_f3": 0.8448, "cvss_f3_score": 84.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 12, "fp": 1, "fn": 1, "recall": 0.9231 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-001", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-333", "file": "crm_project/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-359", "file": "crm_project/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 18, "fp": 25, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4186, "recall": 0.6429, "f1": 0.507, "f2": 0.5806, "f2_score": 58.1, "f3": 0.6102, "f3_score": 61.0, "tpr": 0.6429, "fpr": 0.8929, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 110.5, "cvss_fp_weight": 181.0, "cvss_fn_weight": 50.7, "cvss_precision": 0.3791, "cvss_recall": 0.6855, "cvss_f3": 0.6342, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 7, "fp": 1, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/deals.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 106, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1654, "recall": 0.75, "f1": 0.271, "f2": 0.4393, "f2_score": 43.9, "f3": 0.5541, "f3_score": 55.4, "tpr": 0.75, "fpr": 0.9725, "youden_j": -0.2225, "cvss_coverage": 1.0, "cvss_tp_weight": 127.0, "cvss_fp_weight": 719.5, "cvss_fn_weight": 34.2, "cvss_precision": 0.15, "cvss_recall": 0.7878, "cvss_f3": 0.5528, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 9, "fp": 1, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/middleware.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/deals.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/admin_panel.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/admin_panel.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/admin_panel.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/apikeys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/apikeys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/apikeys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/contacts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/contacts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/contacts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/contacts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/customer_portal.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/deals.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/deals.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/deals.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/deals.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/escalations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/escalations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/escalations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/escalations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/notifications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/notifications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/organizations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/organizations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/organizations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/crm/views/webhooks.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-121", "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-191", "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-439", "file": "crm_project/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/urls.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/admin_panel/user_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/customer_portal/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/deals/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/escalations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": "templates/organizations/detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/invite_accept.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_change_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 2, "fp": 2, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0714, "f1": 0.125, "f2": 0.0862, "f2_score": 8.6, "f3": 0.0781, "f3_score": 7.8, "tpr": 0.0714, "fpr": 0.3333, "youden_j": -0.2619, "cvss_coverage": 1.0, "cvss_tp_weight": 16.7, "cvss_fp_weight": 10.1, "cvss_fn_weight": 144.5, "cvss_precision": 0.6237, "cvss_recall": 0.1036, "cvss_f3": 0.113, "cvss_f3_score": 11.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.4286, "f1": 0.5714, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4511, "f3_score": 45.1, "tpr": 0.4286, "fpr": 0.3333, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 10.1, "cvss_fn_weight": 91.6, "cvss_precision": 0.8735, "cvss_recall": 0.4318, "cvss_f3": 0.4548, "cvss_f3_score": 45.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 14, "fp": 7, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5714, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5128, "f3_score": 51.3, "tpr": 0.5, "fpr": 0.7, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 83.0, "cvss_fp_weight": 21.6, "cvss_fn_weight": 78.2, "cvss_precision": 0.7931, "cvss_recall": 0.5149, "cvss_f3": 0.5336, "cvss_f3_score": 53.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 7, "fp": 1, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-002", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-388", "file": "crm_project/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-149", "file": "crm_project/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-233", "file": "crm_project/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-369", "file": "crm_project/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-419", "file": "crm_project/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/organizations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/imports_exports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 32, "fn": 22, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.1579, "recall": 0.2143, "f1": 0.1818, "f2": 0.2, "f2_score": 20.0, "f3": 0.2069, "f3_score": 20.7, "tpr": 0.2143, "fpr": 0.9412, "youden_j": -0.7269, "cvss_coverage": 1.0, "cvss_tp_weight": 37.5, "cvss_fp_weight": 136.0, "cvss_fn_weight": 123.7, "cvss_precision": 0.2161, "cvss_recall": 0.2326, "cvss_f3": 0.2309, "cvss_f3_score": 23.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 1, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 2, "fp": 1, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": "crm/views/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-451", "file": "crm_project/partner_console.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/apikeys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/apikeys.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/apikeys.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/contacts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/contacts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/deals.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/deals.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/organizations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/organizations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-381", "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/escalations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 18, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8182, "youden_j": -0.8182, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 90.7, "cvss_fn_weight": 161.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/accounts/models.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm/templatetags/crm_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm/views/escalations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm/views/webhooks.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/crm_project/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/accounts/profile.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/escalations/detail.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/registration/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-crm-saas-django/templates/registration/password_change_form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-273", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-399", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-409", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-429", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 33, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1316, "recall": 0.1786, "f1": 0.1515, "f2": 0.1667, "f2_score": 16.7, "f3": 0.1724, "f3_score": 17.2, "tpr": 0.1786, "fpr": 0.8919, "youden_j": -0.7133, "cvss_coverage": 1.0, "cvss_tp_weight": 25.9, "cvss_fp_weight": 175.2, "cvss_fn_weight": 135.3, "cvss_precision": 0.1288, "cvss_recall": 0.1607, "cvss_f3": 0.1568, "cvss_f3_score": 15.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/tests.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/tests.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/dashboard.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/documents.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views/notifications.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-003", "file": "crm_project/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-273", "file": "crm_project/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-399", "file": "crm_project/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-409", "file": "crm_project/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-429", "file": "crm_project/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/invite_accept.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_change_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-002", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-121", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-149", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-191", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-233", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-333", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-359", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-369", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-381", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-388", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-419", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-439", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-451", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-327" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-918" } ] } }, "vc-claude-code-seeded-v2-education-lms-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 18, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.5625, "f1": 0.6667, "f2": 0.6, "f2_score": 60.0, "f3": 0.5806, "f3_score": 58.1, "tpr": 0.5625, "fpr": 0.5, "youden_j": 0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 20.1, "cvss_fn_weight": 81.3, "cvss_precision": 0.832, "cvss_recall": 0.5501, "cvss_f3": 0.5694, "cvss_f3_score": 56.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-334", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 3, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.4375, "f1": 0.5714, "f2": 0.4828, "f2_score": 48.3, "f3": 0.459, "f3_score": 45.9, "tpr": 0.4375, "fpr": 0.4286, "youden_j": 0.0089, "cvss_coverage": 1.0, "cvss_tp_weight": 75.2, "cvss_fp_weight": 10.5, "cvss_fn_weight": 105.5, "cvss_precision": 0.8771, "cvss_recall": 0.4162, "cvss_f3": 0.4392, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 3, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.4375, "f1": 0.5714, "f2": 0.4828, "f2_score": 48.3, "f3": 0.459, "f3_score": 45.9, "tpr": 0.4375, "fpr": 0.4286, "youden_j": 0.0089, "cvss_coverage": 1.0, "cvss_tp_weight": 75.2, "cvss_fp_weight": 10.5, "cvss_fn_weight": 105.5, "cvss_precision": 0.8771, "cvss_recall": 0.4162, "cvss_f3": 0.4392, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/courses/catalog.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 7, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.4688, "f1": 0.5556, "f2": 0.5, "f2_score": 50.0, "f3": 0.4839, "f3_score": 48.4, "tpr": 0.4688, "fpr": 0.6364, "youden_j": -0.1676, "cvss_coverage": 1.0, "cvss_tp_weight": 82.8, "cvss_fp_weight": 30.6, "cvss_fn_weight": 97.9, "cvss_precision": 0.7301, "cvss_recall": 0.4582, "cvss_f3": 0.4759, "cvss_f3_score": 47.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.5, "f1": 0.5926, "f2": 0.5333, "f2_score": 53.3, "f3": 0.5161, "f3_score": 51.6, "tpr": 0.5, "fpr": 0.6, "youden_j": -0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 84.8, "cvss_fp_weight": 30.1, "cvss_fn_weight": 95.9, "cvss_precision": 0.7379, "cvss_recall": 0.4693, "cvss_f3": 0.487, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 0, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2708, "f1": 0.4247, "f2": 0.3167, "f2_score": 31.6, "f3": 0.292, "f3_score": 29.2, "tpr": 0.2708, "fpr": 0.0, "youden_j": 0.2708, "cvss_coverage": 1.0, "cvss_tp_weight": 50.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 130.1, "cvss_precision": 1.0, "cvss_recall": 0.2798, "cvss_f3": 0.3014, "cvss_f3_score": 30.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 1, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.25, "f1": 0.3902, "f2": 0.292, "f2_score": 29.2, "f3": 0.2694, "f3_score": 26.9, "tpr": 0.25, "fpr": 0.2, "youden_j": 0.05, "cvss_coverage": 1.0, "cvss_tp_weight": 48.1, "cvss_fp_weight": 5.0, "cvss_fn_weight": 132.6, "cvss_precision": 0.9055, "cvss_recall": 0.2662, "cvss_f3": 0.2864, "cvss_f3_score": 28.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 11, "fp": 2, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8389, "recall": 0.3541, "f1": 0.4939, "f2": 0.3991, "f2_score": 39.9, "f3": 0.3752, "f3_score": 37.5, "tpr": 0.3541, "fpr": 0.3444, "youden_j": 0.0097, "cvss_coverage": 1.0, "cvss_tp_weight": 59.7, "cvss_fp_weight": 10.2, "cvss_fn_weight": 121.0, "cvss_precision": 0.859, "cvss_recall": 0.3302, "cvss_f3": 0.3515, "cvss_f3_score": 35.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7671, "recall": 0.5104, "f1": 0.612, "f2": 0.5466, "f2_score": 54.7, "f3": 0.5279, "f3_score": 52.8, "tpr": 0.5104, "fpr": 0.5519, "youden_j": -0.0414, "cvss_coverage": 1.0, "cvss_tp_weight": 90.5, "cvss_fp_weight": 16.1, "cvss_fn_weight": 90.2, "cvss_precision": 0.8515, "cvss_recall": 0.5008, "cvss_f3": 0.5221, "cvss_f3_score": 52.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 10, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6618, "recall": 0.5313, "f1": 0.5815, "f2": 0.5487, "f2_score": 54.9, "f3": 0.5396, "f3_score": 53.9, "tpr": 0.5313, "fpr": 0.6672, "youden_j": -0.1359, "cvss_coverage": 1.0, "cvss_tp_weight": 93.6, "cvss_fp_weight": 32.0, "cvss_fn_weight": 87.1, "cvss_precision": 0.764, "cvss_recall": 0.5178, "cvss_f3": 0.5335, "cvss_f3_score": 53.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7037, "recall": 0.5938, "f1": 0.6441, "f2": 0.6129, "f2_score": 61.3, "f3": 0.6032, "f3_score": 60.3, "tpr": 0.5938, "fpr": 0.6667, "youden_j": -0.0729, "cvss_coverage": 1.0, "cvss_tp_weight": 105.5, "cvss_fp_weight": 31.1, "cvss_fn_weight": 75.2, "cvss_precision": 0.7722, "cvss_recall": 0.5838, "cvss_f3": 0.5984, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 6, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6944, "recall": 0.4479, "f1": 0.5445, "f2": 0.4821, "f2_score": 48.2, "f3": 0.4644, "f3_score": 46.4, "tpr": 0.4479, "fpr": 0.6074, "youden_j": -0.1595, "cvss_coverage": 1.0, "cvss_tp_weight": 83.5, "cvss_fp_weight": 18.2, "cvss_fn_weight": 97.2, "cvss_precision": 0.8214, "cvss_recall": 0.4619, "cvss_f3": 0.483, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 15, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9375, "recall": 0.4688, "f1": 0.625, "f2": 0.5208, "f2_score": 52.1, "f3": 0.4934, "f3_score": 49.3, "tpr": 0.4688, "fpr": 0.2, "youden_j": 0.2687, "cvss_coverage": 1.0, "cvss_tp_weight": 83.9, "cvss_fp_weight": 5.0, "cvss_fn_weight": 96.8, "cvss_precision": 0.9436, "cvss_recall": 0.4643, "cvss_f3": 0.4892, "cvss_f3_score": 48.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 32, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 180.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-334", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-360", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": "accounts/views.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": "assignments/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": "courses/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": "accounts/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": "apikeys/views.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 11, "fp": 5, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.3438, "f1": 0.4583, "f2": 0.3819, "f2_score": 38.2, "f3": 0.3618, "f3_score": 36.2, "tpr": 0.3438, "fpr": 0.5556, "youden_j": -0.2118, "cvss_coverage": 1.0, "cvss_tp_weight": 64.9, "cvss_fp_weight": 16.1, "cvss_fn_weight": 115.8, "cvss_precision": 0.8016, "cvss_recall": 0.3592, "cvss_f3": 0.3801, "cvss_f3_score": 38.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 10, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.4375, "f1": 0.5, "f2": 0.4605, "f2_score": 46.1, "f3": 0.4487, "f3_score": 44.9, "tpr": 0.4375, "fpr": 0.7143, "youden_j": -0.2768, "cvss_coverage": 1.0, "cvss_tp_weight": 87.2, "cvss_fp_weight": 45.7, "cvss_fn_weight": 93.5, "cvss_precision": 0.6563, "cvss_recall": 0.4826, "cvss_f3": 0.4957, "cvss_f3_score": 49.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": "assignments/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": "accounts/views.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-430", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 32, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 180.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-334", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-360", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": "accounts/views.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": "assignments/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": "courses/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": "accounts/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": "apikeys/views.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.761, "recall": 0.3958, "f1": 0.5207, "f2": 0.4378, "f2_score": 43.8, "f3": 0.4157, "f3_score": 41.6, "tpr": 0.3958, "fpr": 0.4947, "youden_j": -0.0989, "cvss_coverage": 1.0, "cvss_tp_weight": 66.6, "cvss_fp_weight": 18.6, "cvss_fn_weight": 114.1, "cvss_precision": 0.7851, "cvss_recall": 0.3686, "cvss_f3": 0.3892, "cvss_f3_score": 38.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7813, "recall": 0.3958, "f1": 0.5241, "f2": 0.4387, "f2_score": 43.9, "f3": 0.4161, "f3_score": 41.6, "tpr": 0.3958, "fpr": 0.463, "youden_j": -0.0671, "cvss_coverage": 1.0, "cvss_tp_weight": 70.7, "cvss_fp_weight": 9.3, "cvss_fn_weight": 110.0, "cvss_precision": 0.8853, "cvss_recall": 0.3911, "cvss_f3": 0.414, "cvss_f3_score": 41.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7412, "recall": 0.4479, "f1": 0.5583, "f2": 0.4864, "f2_score": 48.6, "f3": 0.4663, "f3_score": 46.6, "tpr": 0.4479, "fpr": 0.5556, "youden_j": -0.1077, "cvss_coverage": 1.0, "cvss_tp_weight": 80.3, "cvss_fp_weight": 8.5, "cvss_fn_weight": 100.4, "cvss_precision": 0.9043, "cvss_recall": 0.4445, "cvss_f3": 0.4684, "cvss_f3_score": 46.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5625, "f1": 0.6429, "f2": 0.5921, "f2_score": 59.2, "f3": 0.5769, "f3_score": 57.7, "tpr": 0.5625, "fpr": 0.6, "youden_j": -0.0375, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 21.1, "cvss_fn_weight": 81.3, "cvss_precision": 0.825, "cvss_recall": 0.5501, "cvss_f3": 0.569, "cvss_f3_score": 56.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 18, "fp": 9, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5625, "f1": 0.6102, "f2": 0.5806, "f2_score": 58.1, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5625, "fpr": 0.6923, "youden_j": -0.1298, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 49.0, "cvss_fn_weight": 81.7, "cvss_precision": 0.6689, "cvss_recall": 0.5479, "cvss_f3": 0.558, "cvss_f3_score": 55.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-334", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 19, "fp": 41, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3167, "recall": 0.5938, "f1": 0.413, "f2": 0.5053, "f2_score": 50.5, "f3": 0.546, "f3_score": 54.6, "tpr": 0.5938, "fpr": 0.9111, "youden_j": -0.3174, "cvss_coverage": 1.0, "cvss_tp_weight": 106.2, "cvss_fp_weight": 258.0, "cvss_fn_weight": 74.5, "cvss_precision": 0.2916, "cvss_recall": 0.5877, "cvss_f3": 0.5335, "cvss_f3_score": 53.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-472" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-430", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 25, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.625, "f1": 0.5195, "f2": 0.578, "f2_score": 57.8, "f3": 0.6006, "f3_score": 60.1, "tpr": 0.625, "fpr": 0.8621, "youden_j": -0.2371, "cvss_coverage": 1.0, "cvss_tp_weight": 114.4, "cvss_fp_weight": 163.0, "cvss_fn_weight": 66.3, "cvss_precision": 0.4124, "cvss_recall": 0.6331, "cvss_f3": 0.6009, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-360", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": "accounts/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 1, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.125, "f1": 0.2162, "f2": 0.1504, "f2_score": 15.0, "f3": 0.1365, "f3_score": 13.7, "tpr": 0.125, "fpr": 0.2, "youden_j": -0.075, "cvss_coverage": 1.0, "cvss_tp_weight": 18.6, "cvss_fp_weight": 8.0, "cvss_fn_weight": 162.1, "cvss_precision": 0.6992, "cvss_recall": 0.1029, "cvss_f3": 0.1125, "cvss_f3_score": 11.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "notifications/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-382", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-400", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-430", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-452", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 23, "fp": 45, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3382, "recall": 0.7188, "f1": 0.46, "f2": 0.5867, "f2_score": 58.7, "f3": 0.6461, "f3_score": 64.6, "tpr": 0.7188, "fpr": 0.9184, "youden_j": -0.1996, "cvss_coverage": 1.0, "cvss_tp_weight": 127.8, "cvss_fp_weight": 311.0, "cvss_fn_weight": 52.9, "cvss_precision": 0.2912, "cvss_recall": 0.7072, "cvss_f3": 0.6189, "cvss_f3_score": 61.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/models.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-913" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-190" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/courses/enrollment_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/board.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 26, "fp": 9, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7429, "recall": 0.8125, "f1": 0.7761, "f2": 0.7975, "f2_score": 79.8, "f3": 0.805, "f3_score": 80.5, "tpr": 0.8125, "fpr": 0.75, "youden_j": 0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 142.3, "cvss_fp_weight": 64.5, "cvss_fn_weight": 38.4, "cvss_precision": 0.6881, "cvss_recall": 0.7875, "cvss_f3": 0.7763, "cvss_f3_score": 77.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 15, "fp": 1, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-334", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-360", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": "notifications/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 27, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3721, "recall": 0.5, "f1": 0.4267, "f2": 0.4678, "f2_score": 46.8, "f3": 0.4834, "f3_score": 48.3, "tpr": 0.5, "fpr": 0.871, "youden_j": -0.371, "cvss_coverage": 1.0, "cvss_tp_weight": 87.2, "cvss_fp_weight": 171.0, "cvss_fn_weight": 93.5, "cvss_precision": 0.3377, "cvss_recall": 0.4826, "cvss_f3": 0.4627, "cvss_f3_score": 46.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 23, "fp": 70, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2473, "recall": 0.7188, "f1": 0.368, "f2": 0.5204, "f2_score": 52.0, "f3": 0.6037, "f3_score": 60.4, "tpr": 0.7188, "fpr": 0.9459, "youden_j": -0.2272, "cvss_coverage": 1.0, "cvss_tp_weight": 127.8, "cvss_fp_weight": 448.0, "cvss_fn_weight": 52.9, "cvss_precision": 0.222, "cvss_recall": 0.7072, "cvss_f3": 0.5804, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/models.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-913" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-005", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-122", "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-190" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-440", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "notifications/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/courses/enrollment_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/board.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 7, "fn": 23, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5934, "recall": 0.2917, "f1": 0.3896, "f2": 0.3242, "f2_score": 32.4, "f3": 0.307, "f3_score": 30.7, "tpr": 0.2917, "fpr": 0.5421, "youden_j": -0.2505, "cvss_coverage": 1.0, "cvss_tp_weight": 52.0, "cvss_fp_weight": 33.8, "cvss_fn_weight": 128.7, "cvss_precision": 0.6298, "cvss_recall": 0.2878, "cvss_f3": 0.3042, "cvss_f3_score": 30.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 2, "fp": 1, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": "notifications/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/discussions/thread_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/notifications/list.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-150", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-430", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 11, "fp": 7, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.3438, "f1": 0.44, "f2": 0.3767, "f2_score": 37.7, "f3": 0.3595, "f3_score": 35.9, "tpr": 0.3438, "fpr": 0.6364, "youden_j": -0.2926, "cvss_coverage": 1.0, "cvss_tp_weight": 62.7, "cvss_fp_weight": 30.6, "cvss_fn_weight": 118.0, "cvss_precision": 0.6719, "cvss_recall": 0.347, "cvss_f3": 0.3646, "cvss_f3_score": 36.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-234", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": "apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-382", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4688, "f1": 0.5769, "f2": 0.5068, "f2_score": 50.7, "f3": 0.487, "f3_score": 48.7, "tpr": 0.4688, "fpr": 0.5556, "youden_j": -0.0868, "cvss_coverage": 1.0, "cvss_tp_weight": 81.7, "cvss_fp_weight": 16.1, "cvss_fn_weight": 99.0, "cvss_precision": 0.8357, "cvss_recall": 0.4521, "cvss_f3": 0.4739, "cvss_f3_score": 47.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-150", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-389", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-211", "file": "lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-370", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-006", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-420", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 43, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1042, "recall": 0.1562, "f1": 0.125, "f2": 0.142, "f2_score": 14.2, "f3": 0.1488, "f3_score": 14.9, "tpr": 0.1562, "fpr": 0.9149, "youden_j": -0.7586, "cvss_coverage": 1.0, "cvss_tp_weight": 31.2, "cvss_fp_weight": 159.5, "cvss_fn_weight": 149.5, "cvss_precision": 0.1636, "cvss_recall": 0.1727, "cvss_f3": 0.1717, "cvss_f3_score": 17.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-452", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "notifications/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-382", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/management/commands/close_overdue_assignments.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/management/commands/close_overdue_assignments.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-150", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 19, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8261, "youden_j": -0.8261, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 95.4, "cvss_fn_weight": 180.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/accounts/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/accounts/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/accounts/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/accounts/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/accounts/models.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/apikeys/management/commands/deliver_webhooks.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/apikeys/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/courses/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-004", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-150", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-274", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-382", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-400", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-410", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-430", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-452", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 51, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0893, "recall": 0.1562, "f1": 0.1136, "f2": 0.1359, "f2_score": 13.6, "f3": 0.1453, "f3_score": 14.5, "tpr": 0.1562, "fpr": 0.9273, "youden_j": -0.771, "cvss_coverage": 1.0, "cvss_tp_weight": 25.6, "cvss_fp_weight": 265.0, "cvss_fn_weight": 155.1, "cvss_precision": 0.0881, "cvss_recall": 0.1417, "cvss_f3": 0.1336, "cvss_f3_score": 13.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "assignments/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "courses/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "discussions/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-004", "file": "lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-274", "file": "lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-400", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-410", "file": "lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-430", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notifications/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-122", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-150", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-211", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-234", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-334", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-360", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-370", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-382", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-389", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-420", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-440", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-452", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-601" } ] } }, "vc-claude-code-seeded-v2-fintech-lending-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 27, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.7241, "f1": 0.5455, "f2": 0.6402, "f2_score": 64.0, "f3": 0.6796, "f3_score": 68.0, "tpr": 0.7241, "fpr": 0.871, "youden_j": -0.1468, "cvss_coverage": 1.0, "cvss_tp_weight": 134.7, "cvss_fp_weight": 126.9, "cvss_fn_weight": 44.5, "cvss_precision": 0.5149, "cvss_recall": 0.7517, "cvss_f3": 0.7186, "cvss_f3_score": 71.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dependencies.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dependencies.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 18, "fp": 4, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.6207, "f1": 0.7059, "f2": 0.6522, "f2_score": 65.2, "f3": 0.636, "f3_score": 63.6, "tpr": 0.6207, "fpr": 0.5, "youden_j": 0.1207, "cvss_coverage": 1.0, "cvss_tp_weight": 113.4, "cvss_fp_weight": 21.7, "cvss_fn_weight": 65.8, "cvss_precision": 0.8392, "cvss_recall": 0.6328, "cvss_f3": 0.6488, "cvss_f3_score": 64.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8095, "recall": 0.5862, "f1": 0.68, "f2": 0.6204, "f2_score": 62.0, "f3": 0.6028, "f3_score": 60.3, "tpr": 0.5862, "fpr": 0.5, "youden_j": 0.0862, "cvss_coverage": 1.0, "cvss_tp_weight": 107.8, "cvss_fp_weight": 21.7, "cvss_fn_weight": 71.4, "cvss_precision": 0.8323, "cvss_recall": 0.6016, "cvss_f3": 0.6187, "cvss_f3_score": 61.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4828, "f1": 0.5957, "f2": 0.5224, "f2_score": 52.2, "f3": 0.5018, "f3_score": 50.2, "tpr": 0.4828, "fpr": 0.5, "youden_j": -0.0172, "cvss_coverage": 1.0, "cvss_tp_weight": 90.8, "cvss_fp_weight": 11.9, "cvss_fn_weight": 88.4, "cvss_precision": 0.8845, "cvss_recall": 0.5067, "cvss_f3": 0.5293, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 11, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.6552, "f1": 0.6441, "f2": 0.6507, "f2_score": 65.1, "f3": 0.6529, "f3_score": 65.3, "tpr": 0.6552, "fpr": 0.7333, "youden_j": -0.0782, "cvss_coverage": 1.0, "cvss_tp_weight": 121.7, "cvss_fp_weight": 44.9, "cvss_fn_weight": 57.5, "cvss_precision": 0.7303, "cvss_recall": 0.6791, "cvss_f3": 0.6839, "cvss_f3_score": 68.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 2, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4231, "recall": 0.1897, "f1": 0.2619, "f2": 0.2132, "f2_score": 21.3, "f3": 0.2008, "f3_score": 20.1, "tpr": 0.1897, "fpr": 0.2666, "youden_j": -0.077, "cvss_coverage": 1.0, "cvss_tp_weight": 38.7, "cvss_fp_weight": 5.7, "cvss_fn_weight": 140.5, "cvss_precision": 0.4644, "cvss_recall": 0.216, "cvss_f3": 0.2281, "cvss_f3_score": 22.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/views.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 11, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8462, "recall": 0.3793, "f1": 0.5238, "f2": 0.4264, "f2_score": 42.6, "f3": 0.4015, "f3_score": 40.1, "tpr": 0.3793, "fpr": 0.3333, "youden_j": 0.046, "cvss_coverage": 1.0, "cvss_tp_weight": 80.5, "cvss_fp_weight": 5.9, "cvss_fn_weight": 98.7, "cvss_precision": 0.9314, "cvss_recall": 0.4492, "cvss_f3": 0.4737, "cvss_f3_score": 47.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 179.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 179.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 179.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 12, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.6207, "f1": 0.6102, "f2": 0.6164, "f2_score": 61.6, "f3": 0.6186, "f3_score": 61.9, "tpr": 0.6207, "fpr": 0.75, "youden_j": -0.1293, "cvss_coverage": 1.0, "cvss_tp_weight": 115.2, "cvss_fp_weight": 60.2, "cvss_fn_weight": 64.0, "cvss_precision": 0.6567, "cvss_recall": 0.6429, "cvss_f3": 0.6442, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 9, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6618, "recall": 0.5862, "f1": 0.6213, "f2": 0.5997, "f2_score": 60.0, "f3": 0.5929, "f3_score": 59.3, "tpr": 0.5862, "fpr": 0.681, "youden_j": -0.0948, "cvss_coverage": 1.0, "cvss_tp_weight": 113.8, "cvss_fp_weight": 37.2, "cvss_fn_weight": 65.4, "cvss_precision": 0.7533, "cvss_recall": 0.6349, "cvss_f3": 0.6448, "cvss_f3_score": 64.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.4483, "f1": 0.5909, "f2": 0.4962, "f2_score": 49.6, "f3": 0.471, "f3_score": 47.1, "tpr": 0.4483, "fpr": 0.3333, "youden_j": 0.1149, "cvss_coverage": 1.0, "cvss_tp_weight": 84.3, "cvss_fp_weight": 10.9, "cvss_fn_weight": 94.9, "cvss_precision": 0.8859, "cvss_recall": 0.4704, "cvss_f3": 0.4936, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 22, "fp": 15, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5946, "recall": 0.7586, "f1": 0.6667, "f2": 0.719, "f2_score": 71.9, "f3": 0.7383, "f3_score": 73.8, "tpr": 0.7586, "fpr": 0.7895, "youden_j": -0.0309, "cvss_coverage": 1.0, "cvss_tp_weight": 138.4, "cvss_fp_weight": 66.7, "cvss_fn_weight": 40.8, "cvss_precision": 0.6749, "cvss_recall": 0.7723, "cvss_f3": 0.7613, "cvss_f3_score": 76.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.4828, "f1": 0.5714, "f2": 0.5147, "f2_score": 51.5, "f3": 0.4982, "f3_score": 49.8, "tpr": 0.4828, "fpr": 0.6, "youden_j": -0.1172, "cvss_coverage": 1.0, "cvss_tp_weight": 98.7, "cvss_fp_weight": 32.6, "cvss_fn_weight": 80.5, "cvss_precision": 0.7518, "cvss_recall": 0.5508, "cvss_f3": 0.5659, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 17, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7083, "recall": 0.5862, "f1": 0.6415, "f2": 0.6071, "f2_score": 60.7, "f3": 0.5965, "f3_score": 59.6, "tpr": 0.5862, "fpr": 0.6364, "youden_j": -0.0502, "cvss_coverage": 1.0, "cvss_tp_weight": 112.9, "cvss_fp_weight": 28.2, "cvss_fn_weight": 66.3, "cvss_precision": 0.8004, "cvss_recall": 0.63, "cvss_f3": 0.6437, "cvss_f3_score": 64.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/services/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-1284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 29, "fp": 12, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7073, "recall": 1.0, "f1": 0.8286, "f2": 0.9236, "f2_score": 92.4, "f3": 0.9603, "f3_score": 96.0, "tpr": 1.0, "fpr": 0.75, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 179.2, "cvss_fp_weight": 65.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.7333, "cvss_recall": 1.0, "cvss_f3": 0.9649, "cvss_f3_score": 96.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-361", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 15, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7321, "recall": 0.5057, "f1": 0.5909, "f2": 0.5357, "f2_score": 53.5, "f3": 0.5201, "f3_score": 52.0, "tpr": 0.5057, "fpr": 0.5492, "youden_j": -0.0435, "cvss_coverage": 1.0, "cvss_tp_weight": 96.3, "cvss_fp_weight": 16.2, "cvss_fn_weight": 82.9, "cvss_precision": 0.8659, "cvss_recall": 0.5374, "cvss_f3": 0.5579, "cvss_f3_score": 55.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8351, "recall": 0.5172, "f1": 0.6385, "f2": 0.5597, "f2_score": 56.0, "f3": 0.5376, "f3_score": 53.8, "tpr": 0.5172, "fpr": 0.4206, "youden_j": 0.0966, "cvss_coverage": 1.0, "cvss_tp_weight": 97.0, "cvss_fp_weight": 9.7, "cvss_fn_weight": 82.2, "cvss_precision": 0.9093, "cvss_recall": 0.5411, "cvss_f3": 0.5639, "cvss_f3_score": 56.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7444, "recall": 0.5862, "f1": 0.6518, "f2": 0.61, "f2_score": 61.0, "f3": 0.5978, "f3_score": 59.8, "tpr": 0.5862, "fpr": 0.5613, "youden_j": 0.0249, "cvss_coverage": 1.0, "cvss_tp_weight": 112.3, "cvss_fp_weight": 21.3, "cvss_fn_weight": 66.9, "cvss_precision": 0.8454, "cvss_recall": 0.6265, "cvss_f3": 0.6429, "cvss_f3_score": 64.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 7, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.72, "recall": 0.6207, "f1": 0.6667, "f2": 0.6383, "f2_score": 63.8, "f3": 0.6294, "f3_score": 62.9, "tpr": 0.6207, "fpr": 0.6364, "youden_j": -0.0157, "cvss_coverage": 1.0, "cvss_tp_weight": 115.2, "cvss_fp_weight": 23.2, "cvss_fn_weight": 64.0, "cvss_precision": 0.8322, "cvss_recall": 0.6429, "cvss_f3": 0.6578, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 7, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5517, "f1": 0.6154, "f2": 0.5755, "f2_score": 57.6, "f3": 0.5634, "f3_score": 56.3, "tpr": 0.5517, "fpr": 0.6364, "youden_j": -0.0846, "cvss_coverage": 1.0, "cvss_tp_weight": 104.7, "cvss_fp_weight": 50.0, "cvss_fn_weight": 74.5, "cvss_precision": 0.6768, "cvss_recall": 0.5843, "cvss_f3": 0.5924, "cvss_f3_score": 59.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 26, "fp": 71, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.268, "recall": 0.8966, "f1": 0.4127, "f2": 0.6103, "f2_score": 61.0, "f3": 0.7263, "f3_score": 72.6, "tpr": 0.8966, "fpr": 0.9467, "youden_j": -0.0501, "cvss_coverage": 1.0, "cvss_tp_weight": 162.2, "cvss_fp_weight": 453.0, "cvss_fn_weight": 17.0, "cvss_precision": 0.2637, "cvss_recall": 0.9051, "cvss_f3": 0.728, "cvss_f3_score": 72.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 2, "recall": 0.8667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-642" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/schemas/borrower.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/application.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/application.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/services/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dependencies.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/application.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/application.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/audit.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 24, "fp": 31, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4364, "recall": 0.8276, "f1": 0.5714, "f2": 0.7018, "f2_score": 70.2, "f3": 0.7595, "f3_score": 75.9, "tpr": 0.8276, "fpr": 0.8857, "youden_j": -0.0581, "cvss_coverage": 1.0, "cvss_tp_weight": 152.6, "cvss_fp_weight": 210.0, "cvss_fn_weight": 26.6, "cvss_precision": 0.4208, "cvss_recall": 0.8516, "cvss_f3": 0.7725, "cvss_f3_score": 77.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-313" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-313" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-313" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-313" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/schemas/borrower.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/common.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 1, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0345, "f1": 0.0645, "f2": 0.0424, "f2_score": 4.2, "f3": 0.038, "f3_score": 3.8, "tpr": 0.0345, "fpr": 0.2, "youden_j": -0.1655, "cvss_coverage": 1.0, "cvss_tp_weight": 7.4, "cvss_fp_weight": 5.5, "cvss_fn_weight": 171.8, "cvss_precision": 0.5736, "cvss_recall": 0.0413, "cvss_f3": 0.0455, "cvss_f3_score": 4.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 14, "recall": 0.0667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 23, "fp": 59, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2805, "recall": 0.7931, "f1": 0.4144, "f2": 0.5808, "f2_score": 58.1, "f3": 0.6706, "f3_score": 67.1, "tpr": 0.7931, "fpr": 0.9516, "youden_j": -0.1585, "cvss_coverage": 1.0, "cvss_tp_weight": 145.5, "cvss_fp_weight": 362.0, "cvss_fn_weight": 33.7, "cvss_precision": 0.2867, "cvss_recall": 0.8119, "cvss_f3": 0.6862, "cvss_f3_score": 68.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 1, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-361", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApiKeysAndWebhooks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApiKeysAndWebhooks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationDetail.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationDetail.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationWizard.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/UnderwriterQueue.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.ts", "cwe": "CWE-346" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 16, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6279, "recall": 0.931, "f1": 0.75, "f2": 0.8491, "f2_score": 84.9, "f3": 0.8882, "f3_score": 88.8, "tpr": 0.931, "fpr": 0.8, "youden_j": 0.131, "cvss_coverage": 1.0, "cvss_tp_weight": 170.3, "cvss_fp_weight": 115.5, "cvss_fn_weight": 8.9, "cvss_precision": 0.5959, "cvss_recall": 0.9503, "cvss_f3": 0.897, "cvss_f3_score": 89.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 2, "recall": 0.8667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-361", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 5, "fp": 6, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.1724, "f1": 0.25, "f2": 0.1969, "f2_score": 19.7, "f3": 0.1838, "f3_score": 18.4, "tpr": 0.1724, "fpr": 0.6, "youden_j": -0.4276, "cvss_coverage": 1.0, "cvss_tp_weight": 36.3, "cvss_fp_weight": 29.5, "cvss_fn_weight": 142.9, "cvss_precision": 0.5517, "cvss_recall": 0.2026, "cvss_f3": 0.2163, "cvss_f3_score": 21.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 23, "fp": 91, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2018, "recall": 0.7931, "f1": 0.3217, "f2": 0.5, "f2_score": 50.0, "f3": 0.6133, "f3_score": 61.3, "tpr": 0.7931, "fpr": 0.9681, "youden_j": -0.175, "cvss_coverage": 1.0, "cvss_tp_weight": 145.5, "cvss_fp_weight": 568.0, "cvss_fn_weight": 33.7, "cvss_precision": 0.2039, "cvss_recall": 0.8119, "cvss_f3": 0.6255, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 1, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-007", "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-008", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-123", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-192", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-361", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-371", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-411", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-421", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-441", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminUsers.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminUsers.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApiKeysAndWebhooks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApiKeysAndWebhooks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationDetail.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationDetail.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ApplicationWizard.tsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Auth.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/BorrowerProfile.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ImportExport.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/UnderwriterQueue.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 8, "fp": 9, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.443, "recall": 0.2644, "f1": 0.3305, "f2": 0.2873, "f2_score": 28.7, "f3": 0.2754, "f3_score": 27.5, "tpr": 0.2644, "fpr": 0.6758, "youden_j": -0.4114, "cvss_coverage": 1.0, "cvss_tp_weight": 53.2, "cvss_fp_weight": 47.4, "cvss_fn_weight": 126.0, "cvss_precision": 0.4896, "cvss_recall": 0.2971, "cvss_f3": 0.3091, "cvss_f3_score": 30.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 179.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3448, "f1": 0.4545, "f2": 0.3817, "f2_score": 38.2, "f3": 0.3623, "f3_score": 36.2, "tpr": 0.3448, "fpr": 0.5556, "youden_j": -0.2107, "cvss_coverage": 1.0, "cvss_tp_weight": 72.4, "cvss_fp_weight": 12.4, "cvss_fn_weight": 106.8, "cvss_precision": 0.8542, "cvss_recall": 0.404, "cvss_f3": 0.4265, "cvss_f3_score": 42.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-390", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-235", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 21, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2759, "recall": 0.2759, "f1": 0.2759, "f2": 0.2759, "f2_score": 27.6, "f3": 0.2759, "f3_score": 27.6, "tpr": 0.2759, "fpr": 0.84, "youden_j": -0.5641, "cvss_coverage": 1.0, "cvss_tp_weight": 56.4, "cvss_fp_weight": 105.5, "cvss_fn_weight": 122.8, "cvss_precision": 0.3484, "cvss_recall": 0.3147, "cvss_f3": 0.3178, "cvss_f3_score": 31.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-379", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-319", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-449", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 9, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6923, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 43.9, "cvss_fn_weight": 179.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-fintech-lending-fastapi/backend/app/seed.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-168", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-288", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-401", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-431", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 47, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1296, "recall": 0.2414, "f1": 0.1687, "f2": 0.2059, "f2_score": 20.6, "f3": 0.2222, "f3_score": 22.2, "tpr": 0.2414, "fpr": 0.9216, "youden_j": -0.6802, "cvss_coverage": 1.0, "cvss_tp_weight": 47.5, "cvss_fp_weight": 259.3, "cvss_fn_weight": 131.7, "cvss_precision": 0.1548, "cvss_recall": 0.2651, "cvss_f3": 0.2474, "cvss_f3_score": 24.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-009", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-168", "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-288", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-401", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-431", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-007", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-123", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-192", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-235", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-319", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-361", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-371", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-379", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-390", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-411", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-421", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-441", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-449", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] } }, "vc-claude-code-seeded-v2-healthcare-clinic-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 18, "fp": 14, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5625, "recall": 0.6207, "f1": 0.5902, "f2": 0.6081, "f2_score": 60.8, "f3": 0.6143, "f3_score": 61.4, "tpr": 0.6207, "fpr": 0.7778, "youden_j": -0.1571, "cvss_coverage": 1.0, "cvss_tp_weight": 100.0, "cvss_fp_weight": 63.5, "cvss_fn_weight": 59.8, "cvss_precision": 0.6118, "cvss_recall": 0.6258, "cvss_f3": 0.6244, "cvss_f3_score": 62.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-442", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 11, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5926, "recall": 0.5517, "f1": 0.5714, "f2": 0.5594, "f2_score": 55.9, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5517, "fpr": 0.7333, "youden_j": -0.1816, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 35.9, "cvss_fn_weight": 67.2, "cvss_precision": 0.7206, "cvss_recall": 0.5795, "cvss_f3": 0.5911, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-442", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4138, "f1": 0.5333, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4332, "f3_score": 43.3, "tpr": 0.4138, "fpr": 0.5, "youden_j": -0.0862, "cvss_coverage": 1.0, "cvss_tp_weight": 71.9, "cvss_fp_weight": 15.0, "cvss_fn_weight": 87.9, "cvss_precision": 0.8271, "cvss_recall": 0.4499, "cvss_f3": 0.4714, "cvss_f3_score": 47.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.4483, "f1": 0.5652, "f2": 0.4887, "f2_score": 48.9, "f3": 0.4676, "f3_score": 46.8, "tpr": 0.4483, "fpr": 0.5, "youden_j": -0.0517, "cvss_coverage": 1.0, "cvss_tp_weight": 79.3, "cvss_fp_weight": 15.0, "cvss_fn_weight": 80.5, "cvss_precision": 0.8407, "cvss_recall": 0.4962, "cvss_f3": 0.5174, "cvss_f3_score": 51.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 13, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5806, "recall": 0.6207, "f1": 0.6, "f2": 0.6122, "f2_score": 61.2, "f3": 0.6164, "f3_score": 61.6, "tpr": 0.6207, "fpr": 0.7647, "youden_j": -0.144, "cvss_coverage": 1.0, "cvss_tp_weight": 102.2, "cvss_fp_weight": 63.0, "cvss_fn_weight": 57.6, "cvss_precision": 0.6188, "cvss_recall": 0.6395, "cvss_f3": 0.6374, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 0, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3104, "f1": 0.4689, "f2": 0.3587, "f2_score": 35.9, "f3": 0.3327, "f3_score": 33.3, "tpr": 0.3104, "fpr": 0.0, "youden_j": 0.3104, "cvss_coverage": 1.0, "cvss_tp_weight": 57.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 102.6, "cvss_precision": 1.0, "cvss_recall": 0.3577, "cvss_f3": 0.3819, "cvss_f3_score": 38.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 159.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-169", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-251", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-383", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-395", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 11, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8257, "recall": 0.3678, "f1": 0.5085, "f2": 0.4136, "f2_score": 41.4, "f3": 0.3893, "f3_score": 38.9, "tpr": 0.3678, "fpr": 0.3444, "youden_j": 0.0234, "cvss_coverage": 1.0, "cvss_tp_weight": 64.8, "cvss_fp_weight": 8.4, "cvss_fn_weight": 95.0, "cvss_precision": 0.8869, "cvss_recall": 0.4053, "cvss_f3": 0.4285, "cvss_f3_score": 42.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-599" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7552, "recall": 0.5287, "f1": 0.6217, "f2": 0.5623, "f2_score": 56.2, "f3": 0.545, "f3_score": 54.5, "tpr": 0.5287, "fpr": 0.5519, "youden_j": -0.0231, "cvss_coverage": 1.0, "cvss_tp_weight": 90.7, "cvss_fp_weight": 14.1, "cvss_fn_weight": 69.1, "cvss_precision": 0.8667, "cvss_recall": 0.5674, "cvss_f3": 0.5876, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-497" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 15, "fp": 12, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5762, "recall": 0.5172, "f1": 0.5409, "f2": 0.5256, "f2_score": 52.6, "f3": 0.5213, "f3_score": 52.1, "tpr": 0.5172, "fpr": 0.715, "youden_j": -0.1978, "cvss_coverage": 1.0, "cvss_tp_weight": 86.9, "cvss_fp_weight": 35.0, "cvss_fn_weight": 72.9, "cvss_precision": 0.7265, "cvss_recall": 0.5438, "cvss_f3": 0.5571, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-011", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 16, "fp": 12, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.5517, "f1": 0.5614, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5536, "f3_score": 55.4, "tpr": 0.5517, "fpr": 0.75, "youden_j": -0.1983, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 49.4, "cvss_fn_weight": 67.2, "cvss_precision": 0.652, "cvss_recall": 0.5795, "cvss_f3": 0.586, "cvss_f3_score": 58.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 12, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6657, "recall": 0.4138, "f1": 0.5094, "f2": 0.4473, "f2_score": 44.7, "f3": 0.4298, "f3_score": 43.0, "tpr": 0.4138, "fpr": 0.5973, "youden_j": -0.1835, "cvss_coverage": 1.0, "cvss_tp_weight": 74.0, "cvss_fp_weight": 16.0, "cvss_fn_weight": 85.8, "cvss_precision": 0.8222, "cvss_recall": 0.4628, "cvss_f3": 0.4838, "cvss_f3_score": 48.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 8, "fp": 3, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.2759, "f1": 0.4, "f2": 0.315, "f2_score": 31.5, "f3": 0.2941, "f3_score": 29.4, "tpr": 0.2759, "fpr": 0.4286, "youden_j": -0.1527, "cvss_coverage": 1.0, "cvss_tp_weight": 53.3, "cvss_fp_weight": 10.2, "cvss_fn_weight": 106.5, "cvss_precision": 0.8396, "cvss_recall": 0.3335, "cvss_f3": 0.3549, "cvss_f3_score": 35.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 10, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7436, "recall": 1.0, "f1": 0.8529, "f2": 0.9355, "f2_score": 93.5, "f3": 0.9667, "f3_score": 96.7, "tpr": 1.0, "fpr": 0.7143, "youden_j": 0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 159.8, "cvss_fp_weight": 44.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.7838, "cvss_recall": 1.0, "cvss_f3": 0.9732, "cvss_f3_score": 97.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-011", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-335", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-362", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-442", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/models.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/models.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 10, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.3448, "f1": 0.4651, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3636, "f3_score": 36.4, "tpr": 0.3448, "fpr": 0.5, "youden_j": -0.1552, "cvss_coverage": 1.0, "cvss_tp_weight": 66.0, "cvss_fp_weight": 10.7, "cvss_fn_weight": 93.8, "cvss_precision": 0.8607, "cvss_recall": 0.413, "cvss_f3": 0.4357, "cvss_f3_score": 43.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 9, "fp": 18, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.3103, "f1": 0.3214, "f2": 0.3147, "f2_score": 31.5, "f3": 0.3125, "f3_score": 31.2, "tpr": 0.3103, "fpr": 0.8182, "youden_j": -0.5078, "cvss_coverage": 1.0, "cvss_tp_weight": 60.4, "cvss_fp_weight": 78.5, "cvss_fn_weight": 99.4, "cvss_precision": 0.4349, "cvss_recall": 0.378, "cvss_f3": 0.383, "cvss_f3_score": 38.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/scheduling/detail.html", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/models.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 29, "fp": 10, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7436, "recall": 1.0, "f1": 0.8529, "f2": 0.9355, "f2_score": 93.5, "f3": 0.9667, "f3_score": 96.7, "tpr": 1.0, "fpr": 0.7143, "youden_j": 0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 159.8, "cvss_fp_weight": 44.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.7838, "cvss_recall": 1.0, "cvss_f3": 0.9732, "cvss_f3_score": 97.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-011", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-335", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-362", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-442", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/scheduling/detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5965, "recall": 0.3793, "f1": 0.4637, "f2": 0.4091, "f2_score": 40.9, "f3": 0.3936, "f3_score": 39.4, "tpr": 0.3793, "fpr": 0.6462, "youden_j": -0.2668, "cvss_coverage": 1.0, "cvss_tp_weight": 66.6, "cvss_fp_weight": 32.0, "cvss_fn_weight": 93.2, "cvss_precision": 0.6745, "cvss_recall": 0.4164, "cvss_f3": 0.433, "cvss_f3_score": 43.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.651, "recall": 0.4023, "f1": 0.4966, "f2": 0.4353, "f2_score": 43.5, "f3": 0.4181, "f3_score": 41.8, "tpr": 0.4023, "fpr": 0.6074, "youden_j": -0.2051, "cvss_coverage": 1.0, "cvss_tp_weight": 71.3, "cvss_fp_weight": 20.6, "cvss_fn_weight": 88.5, "cvss_precision": 0.7762, "cvss_recall": 0.446, "cvss_f3": 0.4658, "cvss_f3_score": 46.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 12, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5385, "recall": 0.4828, "f1": 0.5091, "f2": 0.493, "f2_score": 49.3, "f3": 0.4878, "f3_score": 48.8, "tpr": 0.4828, "fpr": 0.75, "youden_j": -0.2672, "cvss_coverage": 1.0, "cvss_tp_weight": 83.0, "cvss_fp_weight": 40.7, "cvss_fn_weight": 76.8, "cvss_precision": 0.6708, "cvss_recall": 0.5194, "cvss_f3": 0.5314, "cvss_f3_score": 53.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-362", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5517, "f1": 0.6038, "f2": 0.5714, "f2_score": 57.1, "f3": 0.5614, "f3_score": 56.1, "tpr": 0.5517, "fpr": 0.6667, "youden_j": -0.1149, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 17.0, "cvss_fn_weight": 67.2, "cvss_precision": 0.8447, "cvss_recall": 0.5795, "cvss_f3": 0.5983, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 13, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.5172, "f1": 0.5263, "f2": 0.5208, "f2_score": 52.1, "f3": 0.519, "f3_score": 51.9, "tpr": 0.5172, "fpr": 0.8125, "youden_j": -0.2953, "cvss_coverage": 1.0, "cvss_tp_weight": 85.8, "cvss_fp_weight": 58.0, "cvss_fn_weight": 74.0, "cvss_precision": 0.5967, "cvss_recall": 0.5369, "cvss_f3": 0.5424, "cvss_f3_score": 54.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 2, "precision": 0.5, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 6, "fp": 1, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 22, "fp": 80, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2157, "recall": 0.7586, "f1": 0.3359, "f2": 0.5046, "f2_score": 50.5, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.7586, "fpr": 0.9524, "youden_j": -0.1938, "cvss_coverage": 1.0, "cvss_tp_weight": 121.7, "cvss_fp_weight": 500.0, "cvss_fn_weight": 38.1, "cvss_precision": 0.1958, "cvss_recall": 0.7616, "cvss_f3": 0.5908, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/forms.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-799" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-362", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/admin.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/permissions.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/forms.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/management/commands/deliver_pending_webhooks.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/admin.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-169", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 16, "fp": 26, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.381, "recall": 0.5517, "f1": 0.4507, "f2": 0.5063, "f2_score": 50.6, "f3": 0.5281, "f3_score": 52.8, "tpr": 0.5517, "fpr": 0.8667, "youden_j": -0.3149, "cvss_coverage": 1.0, "cvss_tp_weight": 89.8, "cvss_fp_weight": 171.0, "cvss_fn_weight": 70.0, "cvss_precision": 0.3443, "cvss_recall": 0.562, "cvss_f3": 0.5285, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-169", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 1, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.069, "f1": 0.125, "f2": 0.084, "f2_score": 8.4, "f3": 0.0758, "f3_score": 7.6, "tpr": 0.069, "fpr": 0.2, "youden_j": -0.131, "cvss_coverage": 1.0, "cvss_tp_weight": 13.4, "cvss_fp_weight": 8.0, "cvss_fn_weight": 146.4, "cvss_precision": 0.6262, "cvss_recall": 0.0839, "cvss_f3": 0.0918, "cvss_f3_score": 9.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 1, "fp": 0, "fn": 14, "recall": 0.0667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-169", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-383", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-395", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 18, "fp": 54, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.6207, "f1": 0.3564, "f2": 0.4787, "f2_score": 47.9, "f3": 0.5405, "f3_score": 54.1, "tpr": 0.6207, "fpr": 0.931, "youden_j": -0.3103, "cvss_coverage": 1.0, "cvss_tp_weight": 104.4, "cvss_fp_weight": 369.5, "cvss_fn_weight": 55.4, "cvss_precision": 0.2203, "cvss_recall": 0.6533, "cvss_f3": 0.546, "cvss_f3_score": 54.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/helpers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-011", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 23, "fp": 9, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7188, "recall": 0.7931, "f1": 0.7541, "f2": 0.777, "f2_score": 77.7, "f3": 0.785, "f3_score": 78.5, "tpr": 0.7931, "fpr": 0.6923, "youden_j": 0.1008, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 67.0, "cvss_fn_weight": 29.5, "cvss_precision": 0.6604, "cvss_recall": 0.8154, "cvss_f3": 0.7967, "cvss_f3_score": 79.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/helpers.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-335", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-362", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-442", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 58, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2267, "recall": 0.5862, "f1": 0.3269, "f2": 0.445, "f2_score": 44.5, "f3": 0.506, "f3_score": 50.6, "tpr": 0.5862, "fpr": 0.9355, "youden_j": -0.3493, "cvss_coverage": 1.0, "cvss_tp_weight": 106.2, "cvss_fp_weight": 335.5, "cvss_fn_weight": 53.6, "cvss_precision": 0.2404, "cvss_recall": 0.6646, "cvss_f3": 0.5649, "cvss_f3_score": 56.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 19, "fp": 104, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1545, "recall": 0.6552, "f1": 0.25, "f2": 0.3975, "f2_score": 39.7, "f3": 0.4948, "f3_score": 49.5, "tpr": 0.6552, "fpr": 0.963, "youden_j": -0.3078, "cvss_coverage": 1.0, "cvss_tp_weight": 109.7, "cvss_fp_weight": 656.5, "cvss_fn_weight": 50.1, "cvss_precision": 0.1432, "cvss_recall": 0.6865, "cvss_f3": 0.4976, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/models.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/helpers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/helpers.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-011", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-012", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-193", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-372", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "scheduling/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 2, "fp": 3, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.0518, "f1": 0.0874, "f2": 0.0617, "f2_score": 6.2, "f3": 0.0563, "f3_score": 5.6, "tpr": 0.0518, "fpr": 0.3, "youden_j": -0.2483, "cvss_coverage": 1.0, "cvss_tp_weight": 10.8, "cvss_fp_weight": 14.6, "cvss_fn_weight": 149.0, "cvss_precision": 0.6586, "cvss_recall": 0.0676, "cvss_f3": 0.0736, "cvss_f3_score": 7.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-251", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-383", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-395", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4138, "f1": 0.5106, "f2": 0.4478, "f2_score": 44.8, "f3": 0.4301, "f3_score": 43.0, "tpr": 0.4138, "fpr": 0.6, "youden_j": -0.1862, "cvss_coverage": 1.0, "cvss_tp_weight": 74.0, "cvss_fp_weight": 20.4, "cvss_fn_weight": 85.8, "cvss_precision": 0.7842, "cvss_recall": 0.4631, "cvss_f3": 0.4828, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-010", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-145", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-422", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-412", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-213" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 52, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1186, "recall": 0.2414, "f1": 0.1591, "f2": 0.2, "f2_score": 20.0, "f3": 0.2187, "f3_score": 21.9, "tpr": 0.2414, "fpr": 0.9286, "youden_j": -0.6872, "cvss_coverage": 1.0, "cvss_tp_weight": 46.8, "cvss_fp_weight": 134.0, "cvss_fn_weight": 113.0, "cvss_precision": 0.2588, "cvss_recall": 0.2929, "cvss_f3": 0.2891, "cvss_f3_score": 28.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-453", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-289", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-383", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "medical/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "messaging/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "patients/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "scheduling/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 16, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8, "youden_j": -0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 77.5, "cvss_fn_weight": 159.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/accounts/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/accounts/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/integrations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/templates/accounts/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-healthcare-clinic-django/templates/accounts/register.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-169", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-251", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-383", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-395", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-403", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-432", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 47, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0962, "recall": 0.1724, "f1": 0.1235, "f2": 0.1488, "f2_score": 14.9, "f3": 0.1597, "f3_score": 16.0, "tpr": 0.1724, "fpr": 0.9216, "youden_j": -0.7492, "cvss_coverage": 1.0, "cvss_tp_weight": 32.8, "cvss_fp_weight": 236.9, "cvss_fn_weight": 127.0, "cvss_precision": 0.1216, "cvss_recall": 0.2053, "cvss_f3": 0.192, "cvss_f3_score": 19.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-169", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-251", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-395", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-403", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-432", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/_factories.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/_factories.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-011", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-012", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-145", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-193", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-289", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-335", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-362", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-372", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-383", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-412", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-422", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-442", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-453", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-321" } ] } }, "vc-claude-code-seeded-v2-hr-payroll-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 17, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7083, "recall": 0.6296, "f1": 0.6667, "f2": 0.6439, "f2_score": 64.4, "f3": 0.6367, "f3_score": 63.7, "tpr": 0.6296, "fpr": 0.6364, "youden_j": -0.0067, "cvss_coverage": 1.0, "cvss_tp_weight": 79.1, "cvss_fp_weight": 25.1, "cvss_fn_weight": 48.1, "cvss_precision": 0.759, "cvss_recall": 0.6219, "cvss_f3": 0.6333, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-336", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-443", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5556, "f1": 0.6383, "f2": 0.5859, "f2_score": 58.6, "f3": 0.5703, "f3_score": 57.0, "tpr": 0.5556, "fpr": 0.5556, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 13.3, "cvss_fn_weight": 55.4, "cvss_precision": 0.8436, "cvss_recall": 0.5645, "cvss_f3": 0.5838, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-363", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-443", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.4444, "f1": 0.5217, "f2": 0.4724, "f2_score": 47.2, "f3": 0.458, "f3_score": 45.8, "tpr": 0.4444, "fpr": 0.6364, "youden_j": -0.1919, "cvss_coverage": 1.0, "cvss_tp_weight": 60.9, "cvss_fp_weight": 17.9, "cvss_fn_weight": 66.3, "cvss_precision": 0.7727, "cvss_recall": 0.4788, "cvss_f3": 0.4977, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8125, "recall": 0.4815, "f1": 0.6047, "f2": 0.5242, "f2_score": 52.4, "f3": 0.5019, "f3_score": 50.2, "tpr": 0.4815, "fpr": 0.4286, "youden_j": 0.0529, "cvss_coverage": 1.0, "cvss_tp_weight": 66.4, "cvss_fp_weight": 8.7, "cvss_fn_weight": 60.8, "cvss_precision": 0.8841, "cvss_recall": 0.522, "cvss_f3": 0.5443, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 9, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.5556, "f1": 0.5882, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5618, "f3_score": 56.2, "tpr": 0.5556, "fpr": 0.6923, "youden_j": -0.1368, "cvss_coverage": 1.0, "cvss_tp_weight": 73.7, "cvss_fp_weight": 36.9, "cvss_fn_weight": 53.5, "cvss_precision": 0.6662, "cvss_recall": 0.5794, "cvss_f3": 0.5871, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-843" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/employees/detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3518, "f1": 0.5202, "f2": 0.4042, "f2_score": 40.5, "f3": 0.3762, "f3_score": 37.6, "tpr": 0.3518, "fpr": 0.0, "youden_j": 0.3518, "cvss_coverage": 1.0, "cvss_tp_weight": 55.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 71.3, "cvss_precision": 1.0, "cvss_recall": 0.4391, "cvss_f3": 0.4652, "cvss_f3_score": 46.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 127.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-170", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-252", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-384", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-402", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-454", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 1, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9111, "recall": 0.4691, "f1": 0.6178, "f2": 0.519, "f2_score": 51.9, "f3": 0.4928, "f3_score": 49.3, "tpr": 0.4691, "fpr": 0.2222, "youden_j": 0.2469, "cvss_coverage": 1.0, "cvss_tp_weight": 65.5, "cvss_fp_weight": 3.1, "cvss_fn_weight": 61.7, "cvss_precision": 0.9568, "cvss_recall": 0.5149, "cvss_f3": 0.5398, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 13, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7021, "recall": 0.4938, "f1": 0.5796, "f2": 0.5249, "f2_score": 52.5, "f3": 0.5089, "f3_score": 50.9, "tpr": 0.4938, "fpr": 0.6074, "youden_j": -0.1136, "cvss_coverage": 1.0, "cvss_tp_weight": 68.0, "cvss_fp_weight": 16.0, "cvss_fn_weight": 59.2, "cvss_precision": 0.809, "cvss_recall": 0.5348, "cvss_f3": 0.5536, "cvss_f3_score": 55.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 14, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7338, "recall": 0.5062, "f1": 0.5984, "f2": 0.5394, "f2_score": 53.9, "f3": 0.5222, "f3_score": 52.2, "tpr": 0.5062, "fpr": 0.5519, "youden_j": -0.0457, "cvss_coverage": 1.0, "cvss_tp_weight": 68.9, "cvss_fp_weight": 10.9, "cvss_fn_weight": 58.3, "cvss_precision": 0.8638, "cvss_recall": 0.5419, "cvss_f3": 0.5629, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-124", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 14, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.5185, "f1": 0.6087, "f2": 0.5512, "f2_score": 55.1, "f3": 0.5344, "f3_score": 53.4, "tpr": 0.5185, "fpr": 0.5556, "youden_j": -0.037, "cvss_coverage": 1.0, "cvss_tp_weight": 69.1, "cvss_fp_weight": 13.3, "cvss_fn_weight": 58.1, "cvss_precision": 0.8385, "cvss_recall": 0.5432, "cvss_f3": 0.5631, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 12, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7296, "recall": 0.4321, "f1": 0.5418, "f2": 0.4701, "f2_score": 47.0, "f3": 0.4503, "f3_score": 45.0, "tpr": 0.4321, "fpr": 0.5185, "youden_j": -0.0864, "cvss_coverage": 1.0, "cvss_tp_weight": 62.8, "cvss_fp_weight": 4.6, "cvss_fn_weight": 64.4, "cvss_precision": 0.9333, "cvss_recall": 0.4937, "cvss_f3": 0.518, "cvss_f3_score": 51.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 10, "fp": 2, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.3704, "f1": 0.5128, "f2": 0.4167, "f2_score": 41.7, "f3": 0.3922, "f3_score": 39.2, "tpr": 0.3704, "fpr": 0.3333, "youden_j": 0.037, "cvss_coverage": 1.0, "cvss_tp_weight": 58.3, "cvss_fp_weight": 4.6, "cvss_fn_weight": 68.9, "cvss_precision": 0.9268, "cvss_recall": 0.4583, "cvss_f3": 0.4827, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 10, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.3704, "f1": 0.4651, "f2": 0.4032, "f2_score": 40.3, "f3": 0.3861, "f3_score": 38.6, "tpr": 0.3704, "fpr": 0.6, "youden_j": -0.2296, "cvss_coverage": 1.0, "cvss_tp_weight": 59.1, "cvss_fp_weight": 24.6, "cvss_fn_weight": 68.1, "cvss_precision": 0.7059, "cvss_recall": 0.4646, "cvss_f3": 0.4811, "cvss_f3_score": 48.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/employees/detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.4815, "f1": 0.5778, "f2": 0.5159, "f2_score": 51.6, "f3": 0.4981, "f3_score": 49.8, "tpr": 0.4815, "fpr": 0.5556, "youden_j": -0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 66.4, "cvss_fp_weight": 9.7, "cvss_fn_weight": 60.8, "cvss_precision": 0.8725, "cvss_recall": 0.522, "cvss_f3": 0.5439, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.4444, "f1": 0.5714, "f2": 0.4878, "f2_score": 48.8, "f3": 0.4651, "f3_score": 46.5, "tpr": 0.4444, "fpr": 0.4286, "youden_j": 0.0159, "cvss_coverage": 1.0, "cvss_tp_weight": 67.7, "cvss_fp_weight": 12.3, "cvss_fn_weight": 59.5, "cvss_precision": 0.8461, "cvss_recall": 0.5322, "cvss_f3": 0.5527, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/forms.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 27, "fp": 2, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.931, "recall": 1.0, "f1": 0.9643, "f2": 0.9854, "f2_score": 98.5, "f3": 0.9926, "f3_score": 99.3, "tpr": 1.0, "fpr": 0.3333, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 127.2, "cvss_fp_weight": 1.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.9922, "cvss_recall": 1.0, "cvss_f3": 0.9992, "cvss_f3_score": 99.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-124", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-336", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-363", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-443", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": "employees/views_import_export.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8519, "recall": 0.4321, "f1": 0.5687, "f2": 0.4775, "f2_score": 47.7, "f3": 0.4536, "f3_score": 45.3, "tpr": 0.4321, "fpr": 0.3185, "youden_j": 0.1136, "cvss_coverage": 1.0, "cvss_tp_weight": 62.8, "cvss_fp_weight": 6.0, "cvss_fn_weight": 64.4, "cvss_precision": 0.9155, "cvss_recall": 0.4937, "cvss_f3": 0.5174, "cvss_f3_score": 51.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.4321, "f1": 0.5691, "f2": 0.4781, "f2_score": 47.8, "f3": 0.4539, "f3_score": 45.4, "tpr": 0.4321, "fpr": 0.3651, "youden_j": 0.067, "cvss_coverage": 1.0, "cvss_tp_weight": 62.4, "cvss_fp_weight": 6.0, "cvss_fn_weight": 64.8, "cvss_precision": 0.9133, "cvss_recall": 0.4908, "cvss_f3": 0.5146, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4444, "f1": 0.5581, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4633, "f3_score": 46.3, "tpr": 0.4444, "fpr": 0.5, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 63.7, "cvss_fp_weight": 2.0, "cvss_fn_weight": 63.5, "cvss_precision": 0.9696, "cvss_recall": 0.5008, "cvss_f3": 0.5262, "cvss_f3_score": 52.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 15, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.5556, "f1": 0.625, "f2": 0.5814, "f2_score": 58.1, "f3": 0.5682, "f3_score": 56.8, "tpr": 0.5556, "fpr": 0.6, "youden_j": -0.0444, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 13.8, "cvss_fn_weight": 55.4, "cvss_precision": 0.8387, "cvss_recall": 0.5645, "cvss_f3": 0.5835, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 14, "fp": 3, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.5185, "f1": 0.6364, "f2": 0.56, "f2_score": 56.0, "f3": 0.5385, "f3_score": 53.8, "tpr": 0.5185, "fpr": 0.5, "youden_j": 0.0185, "cvss_coverage": 1.0, "cvss_tp_weight": 71.7, "cvss_fp_weight": 12.0, "cvss_fn_weight": 55.5, "cvss_precision": 0.8566, "cvss_recall": 0.5637, "cvss_f3": 0.5836, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 4, "fp": 1, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-336", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 18, "fp": 41, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3051, "recall": 0.6667, "f1": 0.4186, "f2": 0.5389, "f2_score": 53.9, "f3": 0.596, "f3_score": 59.6, "tpr": 0.6667, "fpr": 0.9111, "youden_j": -0.2444, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 268.5, "cvss_fn_weight": 35.7, "cvss_precision": 0.2542, "cvss_recall": 0.7193, "cvss_f3": 0.6081, "cvss_f3_score": 60.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-843" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/models.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/employees/detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 17, "fp": 15, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5312, "recall": 0.6296, "f1": 0.5763, "f2": 0.6071, "f2_score": 60.7, "f3": 0.6182, "f3_score": 61.8, "tpr": 0.6296, "fpr": 0.7895, "youden_j": -0.1598, "cvss_coverage": 1.0, "cvss_tp_weight": 87.8, "cvss_fp_weight": 101.5, "cvss_fn_weight": 39.4, "cvss_precision": 0.4638, "cvss_recall": 0.6903, "cvss_f3": 0.6581, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/forms.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0741, "f1": 0.1379, "f2": 0.0909, "f2_score": 9.1, "f3": 0.0816, "f3_score": 8.2, "tpr": 0.0741, "fpr": 0.0, "youden_j": 0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 14.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 112.8, "cvss_precision": 1.0, "cvss_recall": 0.1132, "cvss_f3": 0.1242, "cvss_f3_score": 12.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-384", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-402", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-454", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 19, "fp": 62, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2346, "recall": 0.7037, "f1": 0.3519, "f2": 0.5026, "f2_score": 50.3, "f3": 0.5864, "f3_score": 58.6, "tpr": 0.7037, "fpr": 0.9394, "youden_j": -0.2357, "cvss_coverage": 1.0, "cvss_tp_weight": 94.2, "cvss_fp_weight": 404.0, "cvss_fn_weight": 33.0, "cvss_precision": 0.1891, "cvss_recall": 0.7406, "cvss_f3": 0.5733, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/decorators.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-124", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/forms.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal_core/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 13, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.675, "recall": 1.0, "f1": 0.806, "f2": 0.9122, "f2_score": 91.2, "f3": 0.9541, "f3_score": 95.4, "tpr": 1.0, "fpr": 0.7647, "youden_j": 0.2353, "cvss_coverage": 1.0, "cvss_tp_weight": 127.2, "cvss_fp_weight": 89.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.5883, "cvss_recall": 1.0, "cvss_f3": 0.9346, "cvss_f3_score": 93.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": "employees/views_import_export.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-124", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-336", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-363", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": "documents/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-013", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-443", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal_core/notifications.html", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 23, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.425, "recall": 0.6296, "f1": 0.5075, "f2": 0.5743, "f2_score": 57.4, "f3": 0.6007, "f3_score": 60.1, "tpr": 0.6296, "fpr": 0.8519, "youden_j": -0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 84.5, "cvss_fp_weight": 128.0, "cvss_fn_weight": 42.7, "cvss_precision": 0.3976, "cvss_recall": 0.6643, "cvss_f3": 0.6226, "cvss_f3_score": 62.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-363", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-443", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/forms.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 19, "fp": 97, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1638, "recall": 0.7037, "f1": 0.2657, "f2": 0.4241, "f2_score": 42.4, "f3": 0.5292, "f3_score": 52.9, "tpr": 0.7037, "fpr": 0.9604, "youden_j": -0.2567, "cvss_coverage": 1.0, "cvss_tp_weight": 94.2, "cvss_fp_weight": 598.0, "cvss_fn_weight": 33.0, "cvss_precision": 0.1361, "cvss_recall": 0.7406, "cvss_f3": 0.5128, "cvss_f3_score": 51.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/decorators.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/services.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-124", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-194", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/forms.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": "portal_api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/middleware.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal_core/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 5, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4546, "recall": 0.1852, "f1": 0.2631, "f2": 0.2101, "f2_score": 21.0, "f3": 0.1968, "f3_score": 19.7, "tpr": 0.1852, "fpr": 0.3393, "youden_j": -0.1541, "cvss_coverage": 1.0, "cvss_tp_weight": 28.6, "cvss_fp_weight": 4.6, "cvss_fn_weight": 98.6, "cvss_precision": 0.4956, "cvss_recall": 0.2248, "cvss_f3": 0.2379, "cvss_f3_score": 23.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 1, "fp": 1, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-373", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 6, "fp": 7, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.2222, "f1": 0.3, "f2": 0.2479, "f2_score": 24.8, "f3": 0.2344, "f3_score": 23.4, "tpr": 0.2222, "fpr": 0.6364, "youden_j": -0.4141, "cvss_coverage": 1.0, "cvss_tp_weight": 36.9, "cvss_fp_weight": 28.7, "cvss_fn_weight": 90.3, "cvss_precision": 0.5623, "cvss_recall": 0.2901, "cvss_f3": 0.3049, "cvss_f3_score": 30.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-273" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-384", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-454", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 7, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.4074, "f1": 0.4889, "f2": 0.4365, "f2_score": 43.7, "f3": 0.4215, "f3_score": 42.1, "tpr": 0.4074, "fpr": 0.6364, "youden_j": -0.229, "cvss_coverage": 1.0, "cvss_tp_weight": 61.0, "cvss_fp_weight": 25.1, "cvss_fn_weight": 66.2, "cvss_precision": 0.7083, "cvss_recall": 0.4796, "cvss_f3": 0.4956, "cvss_f3_score": 49.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-014", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-391", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-423", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-413", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/services.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 55, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.127, "recall": 0.2963, "f1": 0.1778, "f2": 0.2339, "f2_score": 23.4, "f3": 0.2614, "f3_score": 26.1, "tpr": 0.2963, "fpr": 0.9322, "youden_j": -0.6359, "cvss_coverage": 1.0, "cvss_tp_weight": 45.1, "cvss_fp_weight": 152.0, "cvss_fn_weight": 82.1, "cvss_precision": 0.2288, "cvss_recall": 0.3546, "cvss_f3": 0.3361, "cvss_f3_score": 33.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-454", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/files.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-290", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-384", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views_import_export.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 21, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.84, "youden_j": -0.84, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 86.2, "cvss_fn_weight": 127.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/portal_api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/templates/employees/create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-hr-payroll-django/templates/onboarding/detail.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-170", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-252", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-384", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-402", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-433", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-454", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 39, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1136, "recall": 0.1852, "f1": 0.1408, "f2": 0.1645, "f2_score": 16.4, "f3": 0.1742, "f3_score": 17.4, "tpr": 0.1852, "fpr": 0.907, "youden_j": -0.7218, "cvss_coverage": 1.0, "cvss_tp_weight": 30.3, "cvss_fp_weight": 165.4, "cvss_fn_weight": 96.9, "cvss_precision": 0.1548, "cvss_recall": 0.2382, "cvss_f3": 0.226, "cvss_f3_score": 22.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-015", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-170", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-252", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-402", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-433", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_api/forms.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal_core/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-124", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-194", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-290", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-336", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-363", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-373", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-384", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-391", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-413", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-423", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-443", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-454", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-915" } ] } }, "vc-claude-code-seeded-v2-legal-case-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 23, "fp": 9, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7188, "recall": 0.7419, "f1": 0.7302, "f2": 0.7372, "f2_score": 73.7, "f3": 0.7395, "f3_score": 74.0, "tpr": 0.7419, "fpr": 0.6923, "youden_j": 0.0496, "cvss_coverage": 1.0, "cvss_tp_weight": 112.4, "cvss_fp_weight": 30.0, "cvss_fn_weight": 32.5, "cvss_precision": 0.7894, "cvss_recall": 0.7757, "cvss_f3": 0.7771, "cvss_f3_score": 77.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-444", "file": "legal_firm/case_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4516, "f1": 0.5714, "f2": 0.493, "f2_score": 49.3, "f3": 0.4714, "f3_score": 47.1, "tpr": 0.4516, "fpr": 0.5, "youden_j": -0.0484, "cvss_coverage": 1.0, "cvss_tp_weight": 64.4, "cvss_fp_weight": 2.0, "cvss_fn_weight": 80.5, "cvss_precision": 0.9699, "cvss_recall": 0.4444, "cvss_f3": 0.4699, "cvss_f3_score": 47.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.4516, "f1": 0.6087, "f2": 0.5036, "f2_score": 50.4, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4516, "fpr": 0.2, "youden_j": 0.2516, "cvss_coverage": 1.0, "cvss_tp_weight": 63.8, "cvss_fp_weight": 4.1, "cvss_fn_weight": 81.1, "cvss_precision": 0.9391, "cvss_recall": 0.4403, "cvss_f3": 0.465, "cvss_f3_score": 46.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 1, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9375, "recall": 0.4839, "f1": 0.6383, "f2": 0.5357, "f2_score": 53.6, "f3": 0.5085, "f3_score": 50.8, "tpr": 0.4839, "fpr": 0.2, "youden_j": 0.2839, "cvss_coverage": 1.0, "cvss_tp_weight": 75.6, "cvss_fp_weight": 4.1, "cvss_fn_weight": 69.3, "cvss_precision": 0.9481, "cvss_recall": 0.5217, "cvss_f3": 0.5463, "cvss_f3_score": 54.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 21, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.6774, "f1": 0.7119, "f2": 0.6908, "f2_score": 69.1, "f3": 0.684, "f3_score": 68.4, "tpr": 0.6774, "fpr": 0.6364, "youden_j": 0.0411, "cvss_coverage": 1.0, "cvss_tp_weight": 102.7, "cvss_fp_weight": 29.0, "cvss_fn_weight": 42.2, "cvss_precision": 0.7799, "cvss_recall": 0.7088, "cvss_f3": 0.7153, "cvss_f3_score": 71.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 8, "recall": 0.5789 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 0, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3548, "f1": 0.5238, "f2": 0.4074, "f2_score": 40.7, "f3": 0.3793, "f3_score": 37.9, "tpr": 0.3548, "fpr": 0.0, "youden_j": 0.3548, "cvss_coverage": 1.0, "cvss_tp_weight": 53.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 91.2, "cvss_precision": 1.0, "cvss_recall": 0.3706, "cvss_f3": 0.3955, "cvss_f3_score": 39.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 15, "recall": 0.2105 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 11, "fp": 2, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8462, "recall": 0.3548, "f1": 0.5, "f2": 0.4015, "f2_score": 40.1, "f3": 0.3767, "f3_score": 37.7, "tpr": 0.3548, "fpr": 0.3333, "youden_j": 0.0215, "cvss_coverage": 1.0, "cvss_tp_weight": 54.6, "cvss_fp_weight": 1.0, "cvss_fn_weight": 90.3, "cvss_precision": 0.982, "cvss_recall": 0.3768, "cvss_f3": 0.4016, "cvss_f3_score": 40.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 15, "recall": 0.2105 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-253", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-253", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-253", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.5484, "f1": 0.6415, "f2": 0.5822, "f2_score": 58.2, "f3": 0.5648, "f3_score": 56.5, "tpr": 0.5484, "fpr": 0.5556, "youden_j": -0.0072, "cvss_coverage": 1.0, "cvss_tp_weight": 76.4, "cvss_fp_weight": 9.8, "cvss_fn_weight": 68.5, "cvss_precision": 0.8865, "cvss_recall": 0.5273, "cvss_f3": 0.5495, "cvss_f3_score": 55.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 11, "recall": 0.4211 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 10, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6442, "recall": 0.5806, "f1": 0.6093, "f2": 0.5914, "f2_score": 59.1, "f3": 0.586, "f3_score": 58.6, "tpr": 0.5806, "fpr": 0.7103, "youden_j": -0.1297, "cvss_coverage": 1.0, "cvss_tp_weight": 91.0, "cvss_fp_weight": 23.2, "cvss_fn_weight": 53.9, "cvss_precision": 0.7968, "cvss_recall": 0.6283, "cvss_f3": 0.6415, "cvss_f3_score": 64.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 9, "recall": 0.5263 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 17, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.5484, "f1": 0.6667, "f2": 0.5903, "f2_score": 59.0, "f3": 0.5686, "f3_score": 56.9, "tpr": 0.5484, "fpr": 0.4286, "youden_j": 0.1198, "cvss_coverage": 1.0, "cvss_tp_weight": 82.7, "cvss_fp_weight": 1.5, "cvss_fn_weight": 62.2, "cvss_precision": 0.9822, "cvss_recall": 0.5707, "cvss_f3": 0.5957, "cvss_f3_score": 59.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 11, "recall": 0.4211 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 31, "fp": 5, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8611, "recall": 1.0, "f1": 0.9254, "f2": 0.9687, "f2_score": 96.9, "f3": 0.9841, "f3_score": 98.4, "tpr": 1.0, "fpr": 0.5556, "youden_j": 0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 144.9, "cvss_fp_weight": 20.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.875, "cvss_recall": 1.0, "cvss_f3": 0.9859, "cvss_f3_score": 98.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 19, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-444", "file": "legal_firm/case_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": "cases/views_matters.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": "integrations/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": "accounts/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 17, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5484, "f1": 0.68, "f2": 0.5944, "f2_score": 59.4, "f3": 0.5705, "f3_score": 57.0, "tpr": 0.5484, "fpr": 0.3333, "youden_j": 0.2151, "cvss_coverage": 1.0, "cvss_tp_weight": 88.0, "cvss_fp_weight": 8.3, "cvss_fn_weight": 56.9, "cvss_precision": 0.914, "cvss_recall": 0.6073, "cvss_f3": 0.6284, "cvss_f3_score": 62.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 11, "recall": 0.4211 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 13, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.4839, "f1": 0.5085, "f2": 0.4934, "f2_score": 49.3, "f3": 0.4886, "f3_score": 48.9, "tpr": 0.4839, "fpr": 0.7647, "youden_j": -0.2808, "cvss_coverage": 1.0, "cvss_tp_weight": 84.1, "cvss_fp_weight": 39.3, "cvss_fn_weight": 60.8, "cvss_precision": 0.6817, "cvss_recall": 0.5804, "cvss_f3": 0.5892, "cvss_f3_score": 58.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": "cases/views_matters.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-497" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 31, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 144.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 19, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": "accounts/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": "cases/views_matters.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": "integrations/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-444", "file": "legal_firm/case_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 4, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7524, "recall": 0.3387, "f1": 0.4642, "f2": 0.3795, "f2_score": 38.0, "f3": 0.3579, "f3_score": 35.8, "tpr": 0.3387, "fpr": 0.4182, "youden_j": -0.0795, "cvss_coverage": 1.0, "cvss_tp_weight": 53.0, "cvss_fp_weight": 11.1, "cvss_fn_weight": 91.9, "cvss_precision": 0.8468, "cvss_recall": 0.3654, "cvss_f3": 0.3871, "cvss_f3_score": 38.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8039, "recall": 0.4731, "f1": 0.5944, "f2": 0.515, "f2_score": 51.5, "f3": 0.4932, "f3_score": 49.3, "tpr": 0.4731, "fpr": 0.463, "youden_j": 0.0102, "cvss_coverage": 1.0, "cvss_tp_weight": 75.3, "cvss_fp_weight": 7.9, "cvss_fn_weight": 69.6, "cvss_precision": 0.9101, "cvss_recall": 0.5197, "cvss_f3": 0.5425, "cvss_f3_score": 54.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 7, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6876, "recall": 0.4946, "f1": 0.5749, "f2": 0.5238, "f2_score": 52.4, "f3": 0.5088, "f3_score": 50.9, "tpr": 0.4946, "fpr": 0.6344, "youden_j": -0.1397, "cvss_coverage": 1.0, "cvss_tp_weight": 76.5, "cvss_fp_weight": 13.2, "cvss_fn_weight": 68.4, "cvss_precision": 0.8533, "cvss_recall": 0.5279, "cvss_f3": 0.5489, "cvss_f3_score": 54.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 11, "recall": 0.4211 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.6774, "f1": 0.7241, "f2": 0.6954, "f2_score": 69.5, "f3": 0.6863, "f3_score": 68.6, "tpr": 0.6774, "fpr": 0.6, "youden_j": 0.0774, "cvss_coverage": 1.0, "cvss_tp_weight": 102.7, "cvss_fp_weight": 10.3, "cvss_fn_weight": 42.2, "cvss_precision": 0.909, "cvss_recall": 0.7088, "cvss_f3": 0.7247, "cvss_f3_score": 72.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 8, "recall": 0.5789 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 18, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5806, "f1": 0.6545, "f2": 0.6081, "f2_score": 60.8, "f3": 0.5941, "f3_score": 59.4, "tpr": 0.5806, "fpr": 0.6, "youden_j": -0.0194, "cvss_coverage": 1.0, "cvss_tp_weight": 93.5, "cvss_fp_weight": 30.5, "cvss_fn_weight": 51.4, "cvss_precision": 0.754, "cvss_recall": 0.6453, "cvss_f3": 0.6547, "cvss_f3_score": 65.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 10, "recall": 0.4737 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 29, "fp": 49, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3718, "recall": 0.9355, "f1": 0.5321, "f2": 0.7178, "f2_score": 71.8, "f3": 0.8123, "f3_score": 81.2, "tpr": 0.9355, "fpr": 0.9245, "youden_j": 0.011, "cvss_coverage": 1.0, "cvss_tp_weight": 140.0, "cvss_fp_weight": 314.0, "cvss_fn_weight": 4.9, "cvss_precision": 0.3084, "cvss_recall": 0.9662, "cvss_f3": 0.7963, "cvss_f3_score": 79.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/permissions.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": "cases/views_matters.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/forms.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": "accounts/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 26, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4348, "recall": 0.6452, "f1": 0.5195, "f2": 0.5882, "f2_score": 58.8, "f3": 0.6154, "f3_score": 61.5, "tpr": 0.6452, "fpr": 0.8966, "youden_j": -0.2514, "cvss_coverage": 1.0, "cvss_tp_weight": 100.1, "cvss_fp_weight": 168.5, "cvss_fn_weight": 44.8, "cvss_precision": 0.3727, "cvss_recall": 0.6908, "cvss_f3": 0.6365, "cvss_f3_score": 63.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 1, "fn": 7, "precision": 0.9167, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 7, "recall": 0.6316 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-682" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": "integrations/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-646" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 2, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.0968, "f1": 0.1667, "f2": 0.1163, "f2_score": 11.6, "f3": 0.1056, "f3_score": 10.6, "tpr": 0.0968, "fpr": 0.3333, "youden_j": -0.2366, "cvss_coverage": 1.0, "cvss_tp_weight": 14.2, "cvss_fp_weight": 17.5, "cvss_fn_weight": 130.7, "cvss_precision": 0.4479, "cvss_recall": 0.098, "cvss_f3": 0.1063, "cvss_f3_score": 10.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 17, "recall": 0.1053 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/views_portal.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 51, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3289, "recall": 0.8065, "f1": 0.4673, "f2": 0.625, "f2_score": 62.5, "f3": 0.7042, "f3_score": 70.4, "tpr": 0.8065, "fpr": 0.9273, "youden_j": -0.1208, "cvss_coverage": 1.0, "cvss_tp_weight": 118.7, "cvss_fp_weight": 339.0, "cvss_fn_weight": 26.2, "cvss_precision": 0.2593, "cvss_recall": 0.8192, "cvss_f3": 0.6737, "cvss_f3_score": 67.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 4, "recall": 0.7895 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-754" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/forms.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_change.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/user_create.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/client_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/client_matter_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/document_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/firm_settings.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/matter_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views_matters.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 6, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.9032, "f1": 0.8615, "f2": 0.8861, "f2_score": 88.6, "f3": 0.8946, "f3_score": 89.5, "tpr": 0.9032, "fpr": 0.6, "youden_j": 0.3032, "cvss_coverage": 1.0, "cvss_tp_weight": 128.6, "cvss_fp_weight": 45.5, "cvss_fn_weight": 16.3, "cvss_precision": 0.7387, "cvss_recall": 0.8875, "cvss_f3": 0.87, "cvss_f3_score": 87.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": "accounts/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": "integrations/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-444", "file": "legal_firm/case_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 34, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3818, "recall": 0.6774, "f1": 0.4884, "f2": 0.5866, "f2_score": 58.7, "f3": 0.6287, "f3_score": 62.9, "tpr": 0.6774, "fpr": 0.8947, "youden_j": -0.2173, "cvss_coverage": 1.0, "cvss_tp_weight": 104.1, "cvss_fp_weight": 182.0, "cvss_fn_weight": 40.8, "cvss_precision": 0.3639, "cvss_recall": 0.7184, "cvss_f3": 0.6546, "cvss_f3_score": 65.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": "cases/views_clients.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 107, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1894, "recall": 0.8065, "f1": 0.3067, "f2": 0.4883, "f2_score": 48.8, "f3": 0.6083, "f3_score": 60.8, "tpr": 0.8065, "fpr": 0.964, "youden_j": -0.1575, "cvss_coverage": 1.0, "cvss_tp_weight": 118.7, "cvss_fp_weight": 648.0, "cvss_fn_weight": 26.2, "cvss_precision": 0.1548, "cvss_recall": 0.8192, "cvss_f3": 0.5732, "cvss_f3_score": 57.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 4, "recall": 0.7895 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "api_views.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/services.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_minimal.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_core.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_portal.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_portal.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-754" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/forms.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-017", "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-125", "file": "legal_firm/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-364", "file": "legal_firm/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": "legal_firm/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": "legal_firm/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_change.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/user_create.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/client_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/client_matter_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/document_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/firm_settings.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/matter_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "views_documents.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "views_matters.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "views_matters.py", "cwe": "CWE-697" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 144.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-253", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 7, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.4194, "f1": 0.5098, "f2": 0.4514, "f2_score": 45.1, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4194, "fpr": 0.6364, "youden_j": -0.217, "cvss_coverage": 1.0, "cvss_tp_weight": 68.6, "cvss_fp_weight": 29.0, "cvss_fn_weight": 76.3, "cvss_precision": 0.703, "cvss_recall": 0.4734, "cvss_f3": 0.4894, "cvss_f3_score": 48.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-478" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-392", "file": "legal_firm/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-414", "file": "legal_firm/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-374", "file": "legal_firm/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-346", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-424", "file": "legal_firm/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-018", "file": "legal_firm/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/forms.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 37, "fn": 23, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1778, "recall": 0.2581, "f1": 0.2105, "f2": 0.2367, "f2_score": 23.7, "f3": 0.2469, "f3_score": 24.7, "tpr": 0.2581, "fpr": 0.925, "youden_j": -0.6669, "cvss_coverage": 1.0, "cvss_tp_weight": 39.6, "cvss_fp_weight": 111.5, "cvss_fn_weight": 105.3, "cvss_precision": 0.2621, "cvss_recall": 0.2733, "cvss_f3": 0.2721, "cvss_f3_score": 27.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 7, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 15, "recall": 0.2105 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": "cases/views_documents.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-455", "file": "legal_firm/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/api_views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "integrations/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-291", "file": "legal_firm/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-385", "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_clients.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_core.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_core.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_matters.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views_tasks.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 20, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8333, "youden_j": -0.8333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 82.8, "cvss_fn_weight": 144.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/cases/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/cases/management/commands/seed_minimal.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/cases/templatetags/cases_extras.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/integrations/api_views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/legal_firm/case_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/templates/accounts/user_create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/templates/cases/client_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/templates/cases/document_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/templates/cases/matter_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-legal-case-django/templates/cases/task_form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-171", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-212", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-253", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-404", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-434", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 62, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1014, "recall": 0.2258, "f1": 0.14, "f2": 0.1813, "f2_score": 18.1, "f3": 0.2011, "f3_score": 20.1, "tpr": 0.2258, "fpr": 0.9394, "youden_j": -0.7136, "cvss_coverage": 1.0, "cvss_tp_weight": 30.4, "cvss_fp_weight": 272.8, "cvss_fn_weight": 114.5, "cvss_precision": 0.1003, "cvss_recall": 0.2098, "cvss_f3": 0.1891, "cvss_f3_score": 18.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-016", "file": "legal_firm/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-171", "file": "legal_firm/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-212", "file": "legal_firm/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-253", "file": "legal_firm/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-404", "file": "legal_firm/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-434", "file": "legal_firm/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legal_firm/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_change.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/password_reset_confirm.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/user_create.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/client_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/document_form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/firm_settings.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/cases/matter_form.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-125", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-291", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-346", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-364", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-374", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-385", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-392", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-414", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-424", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-444", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-455", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] } }, "vc-claude-code-seeded-v2-logistics-dispatch-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 24, "fp": 6, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.7273, "f1": 0.7619, "f2": 0.7407, "f2_score": 74.1, "f3": 0.7339, "f3_score": 73.4, "tpr": 0.7273, "fpr": 0.6667, "youden_j": 0.0606, "cvss_coverage": 1.0, "cvss_tp_weight": 132.5, "cvss_fp_weight": 25.1, "cvss_fn_weight": 49.2, "cvss_precision": 0.841, "cvss_recall": 0.7292, "cvss_f3": 0.739, "cvss_f3_score": 73.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 6, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-445", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 12, "fn": 16, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.5152, "f1": 0.5484, "f2": 0.528, "f2_score": 52.8, "f3": 0.5215, "f3_score": 52.1, "tpr": 0.5152, "fpr": 0.8, "youden_j": -0.2848, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 41.3, "cvss_fn_weight": 86.0, "cvss_precision": 0.6986, "cvss_recall": 0.5267, "cvss_f3": 0.54, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 1, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 4, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.4545, "f1": 0.5769, "f2": 0.4967, "f2_score": 49.7, "f3": 0.4747, "f3_score": 47.5, "tpr": 0.4545, "fpr": 0.5714, "youden_j": -0.1169, "cvss_coverage": 1.0, "cvss_tp_weight": 83.6, "cvss_fp_weight": 15.2, "cvss_fn_weight": 98.1, "cvss_precision": 0.8459, "cvss_recall": 0.4601, "cvss_f3": 0.4821, "cvss_f3_score": 48.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 1, "fn": 10, "precision": 0.8571, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 1, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": "backend/app/routers/io_csv.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 0, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4242, "f1": 0.5957, "f2": 0.4795, "f2_score": 47.9, "f3": 0.4502, "f3_score": 45.0, "tpr": 0.4242, "fpr": 0.0, "youden_j": 0.4242, "cvss_coverage": 1.0, "cvss_tp_weight": 81.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 100.7, "cvss_precision": 1.0, "cvss_recall": 0.4458, "cvss_f3": 0.4719, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 14, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 5, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.4848, "f1": 0.5926, "f2": 0.5229, "f2_score": 52.3, "f3": 0.5031, "f3_score": 50.3, "tpr": 0.4848, "fpr": 0.625, "youden_j": -0.1402, "cvss_coverage": 1.0, "cvss_tp_weight": 86.9, "cvss_fp_weight": 20.1, "cvss_fn_weight": 94.8, "cvss_precision": 0.8118, "cvss_recall": 0.4783, "cvss_f3": 0.4988, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 1, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 12, "fp": 0, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9616, "recall": 0.3484, "f1": 0.5109, "f2": 0.3992, "f2_score": 40.0, "f3": 0.3721, "f3_score": 37.2, "tpr": 0.3484, "fpr": 0.125, "youden_j": 0.2234, "cvss_coverage": 1.0, "cvss_tp_weight": 65.1, "cvss_fp_weight": 2.5, "cvss_fn_weight": 116.6, "cvss_precision": 0.9658, "cvss_recall": 0.3583, "cvss_f3": 0.3823, "cvss_f3_score": 38.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 1, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 1, "fp": 1, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0303, "f1": 0.0571, "f2": 0.0373, "f2_score": 3.7, "f3": 0.0334, "f3_score": 3.3, "tpr": 0.0303, "fpr": 0.2, "youden_j": -0.1697, "cvss_coverage": 1.0, "cvss_tp_weight": 7.4, "cvss_fp_weight": 0.5, "cvss_fn_weight": 174.3, "cvss_precision": 0.9367, "cvss_recall": 0.0407, "cvss_f3": 0.045, "cvss_f3_score": 4.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 6, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.5758, "f1": 0.6552, "f2": 0.6051, "f2_score": 60.5, "f3": 0.5901, "f3_score": 59.0, "tpr": 0.5758, "fpr": 0.6667, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 16.2, "cvss_fn_weight": 75.7, "cvss_precision": 0.8672, "cvss_recall": 0.5834, "cvss_f3": 0.6031, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7584, "recall": 0.5354, "f1": 0.6273, "f2": 0.5686, "f2_score": 56.9, "f3": 0.5515, "f3_score": 55.1, "tpr": 0.5354, "fpr": 0.6037, "youden_j": -0.0683, "cvss_coverage": 1.0, "cvss_tp_weight": 100.2, "cvss_fp_weight": 14.6, "cvss_fn_weight": 81.5, "cvss_precision": 0.8759, "cvss_recall": 0.5515, "cvss_f3": 0.5725, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 15, "fp": 5, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4545, "f1": 0.566, "f2": 0.4934, "f2_score": 49.3, "f3": 0.4732, "f3_score": 47.3, "tpr": 0.4545, "fpr": 0.625, "youden_j": -0.1705, "cvss_coverage": 1.0, "cvss_tp_weight": 79.5, "cvss_fp_weight": 15.7, "cvss_fn_weight": 102.2, "cvss_precision": 0.8348, "cvss_recall": 0.4375, "cvss_f3": 0.4594, "cvss_f3_score": 45.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 1, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 15, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.7576, "f1": 0.6849, "f2": 0.7267, "f2_score": 72.7, "f3": 0.7418, "f3_score": 74.2, "tpr": 0.7576, "fpr": 0.8333, "youden_j": -0.0758, "cvss_coverage": 1.0, "cvss_tp_weight": 140.8, "cvss_fp_weight": 64.8, "cvss_fn_weight": 40.9, "cvss_precision": 0.6847, "cvss_recall": 0.7749, "cvss_f3": 0.7648, "cvss_f3_score": 76.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 1, "fn": 7, "recall": 0.6111 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 18, "fp": 2, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.9, "recall": 0.5455, "f1": 0.6792, "f2": 0.5921, "f2_score": 59.2, "f3": 0.5678, "f3_score": 56.8, "tpr": 0.5455, "fpr": 0.4, "youden_j": 0.1455, "cvss_coverage": 1.0, "cvss_tp_weight": 102.2, "cvss_fp_weight": 9.8, "cvss_fn_weight": 79.5, "cvss_precision": 0.9123, "cvss_recall": 0.5625, "cvss_f3": 0.5849, "cvss_f3_score": 58.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 1, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 7, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.4545, "f1": 0.5455, "f2": 0.487, "f2_score": 48.7, "f3": 0.4702, "f3_score": 47.0, "tpr": 0.4545, "fpr": 0.7, "youden_j": -0.2455, "cvss_coverage": 1.0, "cvss_tp_weight": 93.9, "cvss_fp_weight": 30.0, "cvss_fn_weight": 87.8, "cvss_precision": 0.7581, "cvss_recall": 0.5168, "cvss_f3": 0.5338, "cvss_f3_score": 53.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 1, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/io_csv.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 9, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 1.0, "f1": 0.88, "f2": 0.9483, "f2_score": 94.8, "f3": 0.9735, "f3_score": 97.3, "tpr": 1.0, "fpr": 0.75, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 181.7, "cvss_fp_weight": 35.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.837, "cvss_recall": 1.0, "cvss_f3": 0.9809, "cvss_f3_score": 98.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 1, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-126", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-445", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 6, "fn": 20, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6836, "recall": 0.3838, "f1": 0.4871, "f2": 0.419, "f2_score": 41.9, "f3": 0.4006, "f3_score": 40.1, "tpr": 0.3838, "fpr": 0.6313, "youden_j": -0.2475, "cvss_coverage": 1.0, "cvss_tp_weight": 70.7, "cvss_fp_weight": 13.3, "cvss_fn_weight": 111.0, "cvss_precision": 0.8404, "cvss_recall": 0.3891, "cvss_f3": 0.4107, "cvss_f3_score": 41.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 1, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 16, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7803, "recall": 0.4697, "f1": 0.585, "f2": 0.5097, "f2_score": 51.0, "f3": 0.4889, "f3_score": 48.9, "tpr": 0.4697, "fpr": 0.5476, "youden_j": -0.0779, "cvss_coverage": 1.0, "cvss_tp_weight": 86.4, "cvss_fp_weight": 13.2, "cvss_fn_weight": 95.3, "cvss_precision": 0.8677, "cvss_recall": 0.4756, "cvss_f3": 0.498, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 18, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7112, "recall": 0.5354, "f1": 0.6091, "f2": 0.5623, "f2_score": 56.2, "f3": 0.5485, "f3_score": 54.9, "tpr": 0.5354, "fpr": 0.6508, "youden_j": -0.1154, "cvss_coverage": 1.0, "cvss_tp_weight": 99.3, "cvss_fp_weight": 19.8, "cvss_fn_weight": 82.4, "cvss_precision": 0.8328, "cvss_recall": 0.5463, "cvss_f3": 0.5657, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 19, "fp": 7, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7308, "recall": 0.5758, "f1": 0.6441, "f2": 0.6013, "f2_score": 60.1, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.5758, "fpr": 0.7, "youden_j": -0.1242, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 21.1, "cvss_fn_weight": 75.7, "cvss_precision": 0.8337, "cvss_recall": 0.5834, "cvss_f3": 0.6014, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 1, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 2, "fp": 2, "fn": 31, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0606, "f1": 0.1081, "f2": 0.0735, "f2_score": 7.4, "f3": 0.0664, "f3_score": 6.6, "tpr": 0.0606, "fpr": 0.4, "youden_j": -0.3394, "cvss_coverage": 1.0, "cvss_tp_weight": 13.9, "cvss_fp_weight": 16.0, "cvss_fn_weight": 167.8, "cvss_precision": 0.4649, "cvss_recall": 0.0765, "cvss_f3": 0.0835, "cvss_f3_score": 8.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 1, "fn": 17, "recall": 0.0556 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 30, "fp": 50, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.9091, "f1": 0.531, "f2": 0.7075, "f2_score": 70.8, "f3": 0.7958, "f3_score": 79.6, "tpr": 0.9091, "fpr": 0.9434, "youden_j": -0.0343, "cvss_coverage": 1.0, "cvss_tp_weight": 169.2, "cvss_fp_weight": 328.5, "cvss_fn_weight": 12.5, "cvss_precision": 0.34, "cvss_recall": 0.9312, "cvss_f3": 0.7932, "cvss_f3_score": 79.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 1, "fn": 1, "recall": 0.9444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/admin_misc.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 21, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4878, "recall": 0.6061, "f1": 0.5405, "f2": 0.578, "f2_score": 57.8, "f3": 0.5917, "f3_score": 59.2, "tpr": 0.6061, "fpr": 0.875, "youden_j": -0.2689, "cvss_coverage": 1.0, "cvss_tp_weight": 116.2, "cvss_fp_weight": 155.5, "cvss_fn_weight": 65.5, "cvss_precision": 0.4277, "cvss_recall": 0.6395, "cvss_f3": 0.6093, "cvss_f3_score": 60.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 1, "fn": 7, "recall": 0.6111 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-923" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 6, "fp": 2, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.1818, "f1": 0.2927, "f2": 0.2143, "f2_score": 21.4, "f3": 0.1967, "f3_score": 19.7, "tpr": 0.1818, "fpr": 0.3333, "youden_j": -0.1515, "cvss_coverage": 1.0, "cvss_tp_weight": 33.0, "cvss_fp_weight": 16.0, "cvss_fn_weight": 148.7, "cvss_precision": 0.6735, "cvss_recall": 0.1816, "cvss_f3": 0.1959, "cvss_f3_score": 19.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 29, "fp": 39, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4265, "recall": 0.8788, "f1": 0.5743, "f2": 0.725, "f2_score": 72.5, "f3": 0.7945, "f3_score": 79.5, "tpr": 0.8788, "fpr": 0.9286, "youden_j": -0.0498, "cvss_coverage": 1.0, "cvss_tp_weight": 157.7, "cvss_fp_weight": 251.5, "cvss_fn_weight": 24.0, "cvss_precision": 0.3854, "cvss_recall": 0.8679, "cvss_f3": 0.7713, "cvss_f3_score": 77.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 1, "fn": 1, "recall": 0.9444 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-126", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 30, "fp": 15, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.9091, "f1": 0.7692, "f2": 0.8475, "f2_score": 84.7, "f3": 0.8772, "f3_score": 87.7, "tpr": 0.9091, "fpr": 0.8333, "youden_j": 0.0758, "cvss_coverage": 1.0, "cvss_tp_weight": 163.4, "cvss_fp_weight": 110.0, "cvss_fn_weight": 18.3, "cvss_precision": 0.5977, "cvss_recall": 0.8993, "cvss_f3": 0.8561, "cvss_f3_score": 85.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 1, "fn": 1, "recall": 0.9444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-126", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-445", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 5, "fp": 7, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.1515, "f1": 0.2222, "f2": 0.1736, "f2_score": 17.4, "f3": 0.1618, "f3_score": 16.2, "tpr": 0.1515, "fpr": 0.6364, "youden_j": -0.4848, "cvss_coverage": 1.0, "cvss_tp_weight": 32.2, "cvss_fp_weight": 36.5, "cvss_fn_weight": 149.5, "cvss_precision": 0.4687, "cvss_recall": 0.1772, "cvss_f3": 0.189, "cvss_f3_score": 18.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 29, "fp": 71, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.29, "recall": 0.8788, "f1": 0.4361, "f2": 0.625, "f2_score": 62.5, "f3": 0.7305, "f3_score": 73.0, "tpr": 0.8788, "fpr": 0.9595, "youden_j": -0.0807, "cvss_coverage": 1.0, "cvss_tp_weight": 157.7, "cvss_fp_weight": 428.5, "cvss_fn_weight": 24.0, "cvss_precision": 0.269, "cvss_recall": 0.8679, "cvss_f3": 0.7099, "cvss_f3_score": 71.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 1, "fn": 1, "recall": 0.9444 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-019", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-020", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-126", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-304", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-365", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-435", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_misc.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_misc.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_misc.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/io_csv.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/io_csv.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/io_csv.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.tsx", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/RoutesList.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/WorkerDashboard.tsx", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 4, "fn": 24, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.2727, "f1": 0.3913, "f2": 0.3103, "f2_score": 31.0, "f3": 0.2903, "f3_score": 29.0, "tpr": 0.2727, "fpr": 0.5714, "youden_j": -0.2987, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 19.6, "cvss_fn_weight": 126.6, "cvss_precision": 0.7372, "cvss_recall": 0.3032, "cvss_f3": 0.3222, "cvss_f3_score": 32.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 9, "fp": 11, "fn": 24, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.45, "recall": 0.2727, "f1": 0.3396, "f2": 0.2961, "f2_score": 29.6, "f3": 0.2839, "f3_score": 28.4, "tpr": 0.2727, "fpr": 0.7857, "youden_j": -0.513, "cvss_coverage": 1.0, "cvss_tp_weight": 55.4, "cvss_fp_weight": 54.0, "cvss_fn_weight": 126.3, "cvss_precision": 0.5063, "cvss_recall": 0.3049, "cvss_f3": 0.3175, "cvss_f3_score": 31.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-409" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-665" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 13, "fn": 18, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.4545, "f1": 0.4918, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4615, "f3_score": 46.2, "tpr": 0.4545, "fpr": 0.8667, "youden_j": -0.4121, "cvss_coverage": 1.0, "cvss_tp_weight": 93.3, "cvss_fp_weight": 46.2, "cvss_fn_weight": 88.4, "cvss_precision": 0.6688, "cvss_recall": 0.5135, "cvss_f3": 0.5257, "cvss_f3_score": 52.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 2, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-415", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-231", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-425", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-375", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-393", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": "backend/app/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/routers/public_api.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 20, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2308, "recall": 0.1818, "f1": 0.2034, "f2": 0.1899, "f2_score": 19.0, "f3": 0.1858, "f3_score": 18.6, "tpr": 0.1818, "fpr": 0.8333, "youden_j": -0.6515, "cvss_coverage": 1.0, "cvss_tp_weight": 38.8, "cvss_fp_weight": 92.0, "cvss_fn_weight": 142.9, "cvss_precision": 0.2966, "cvss_recall": 0.2135, "cvss_f3": 0.2197, "cvss_f3_score": 22.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-380", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-320", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-450", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminExport.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/JobDetail.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordReset.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.tsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 8, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6667, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 39.3, "cvss_fn_weight": 181.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/webhooks.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-logistics-dispatch-fastapi/backend/app/webhooks.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-021", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-172", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-254", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-405", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 25, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.1515, "f1": 0.1587, "f2": 0.1543, "f2_score": 15.4, "f3": 0.1529, "f3_score": 15.3, "tpr": 0.1515, "fpr": 0.8621, "youden_j": -0.7106, "cvss_coverage": 1.0, "cvss_tp_weight": 28.0, "cvss_fp_weight": 131.9, "cvss_fn_weight": 153.7, "cvss_precision": 0.1751, "cvss_recall": 0.1541, "cvss_f3": 0.156, "cvss_f3_score": 15.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-021", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-172", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-254", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-405", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.ts", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-019", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-020", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-126", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-231", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-304", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-320", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-365", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-375", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-380", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-393", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-415", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-425", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-435", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-445", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-450", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-enrich-014", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] } }, "vc-claude-code-seeded-v2-marketplace-commerce-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 9, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.625, "f1": 0.6557, "f2": 0.6369, "f2_score": 63.7, "f3": 0.6309, "f3_score": 63.1, "tpr": 0.625, "fpr": 0.6923, "youden_j": -0.0673, "cvss_coverage": 1.0, "cvss_tp_weight": 119.8, "cvss_fp_weight": 44.9, "cvss_fn_weight": 61.6, "cvss_precision": 0.7275, "cvss_recall": 0.6604, "cvss_f3": 0.6666, "cvss_f3_score": 66.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 10, "fp": 0, "fn": 9, "recall": 0.5263 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-436", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-446", "file": "backend/app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4375, "f1": 0.5833, "f2": 0.4861, "f2_score": 48.6, "f3": 0.4605, "f3_score": 46.1, "tpr": 0.4375, "fpr": 0.3333, "youden_j": 0.1042, "cvss_coverage": 1.0, "cvss_tp_weight": 86.0, "cvss_fp_weight": 6.0, "cvss_fn_weight": 95.4, "cvss_precision": 0.9343, "cvss_recall": 0.4741, "cvss_f3": 0.4987, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 0.3438, "f1": 0.5, "f2": 0.3929, "f2_score": 39.3, "f3": 0.3667, "f3_score": 36.7, "tpr": 0.3438, "fpr": 0.2, "youden_j": 0.1437, "cvss_coverage": 1.0, "cvss_tp_weight": 67.7, "cvss_fp_weight": 5.5, "cvss_fn_weight": 113.7, "cvss_precision": 0.9243, "cvss_recall": 0.3732, "cvss_f3": 0.3969, "cvss_f3_score": 39.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 2, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.375, "f1": 0.5217, "f2": 0.4225, "f2_score": 42.3, "f3": 0.3974, "f3_score": 39.7, "tpr": 0.375, "fpr": 0.3333, "youden_j": 0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 78.0, "cvss_fp_weight": 6.0, "cvss_fn_weight": 103.4, "cvss_precision": 0.928, "cvss_recall": 0.43, "cvss_f3": 0.4544, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 14, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4375, "f1": 0.56, "f2": 0.4795, "f2_score": 47.9, "f3": 0.4575, "f3_score": 45.8, "tpr": 0.4375, "fpr": 0.5, "youden_j": -0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 81.2, "cvss_fp_weight": 22.2, "cvss_fn_weight": 100.2, "cvss_precision": 0.7854, "cvss_recall": 0.4476, "cvss_f3": 0.4677, "cvss_f3_score": 46.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 0, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2813, "f1": 0.4353, "f2": 0.3275, "f2_score": 32.8, "f3": 0.3026, "f3_score": 30.2, "tpr": 0.2813, "fpr": 0.0, "youden_j": 0.2813, "cvss_coverage": 1.0, "cvss_tp_weight": 56.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 125.1, "cvss_precision": 1.0, "cvss_recall": 0.3106, "cvss_f3": 0.3332, "cvss_f3_score": 33.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 17, "recall": 0.1053 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 1, "fp": 1, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0312, "f1": 0.0588, "f2": 0.0385, "f2_score": 3.8, "f3": 0.0345, "f3_score": 3.4, "tpr": 0.0312, "fpr": 0.2, "youden_j": -0.1688, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 0.5, "cvss_fn_weight": 172.3, "cvss_precision": 0.9479, "cvss_recall": 0.0502, "cvss_f3": 0.0554, "cvss_f3_score": 5.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7037, "recall": 0.5938, "f1": 0.6441, "f2": 0.6129, "f2_score": 61.3, "f3": 0.6032, "f3_score": 60.3, "tpr": 0.5938, "fpr": 0.6667, "youden_j": -0.0729, "cvss_coverage": 1.0, "cvss_tp_weight": 111.7, "cvss_fp_weight": 29.2, "cvss_fn_weight": 69.7, "cvss_precision": 0.7926, "cvss_recall": 0.6158, "cvss_f3": 0.6298, "cvss_f3_score": 63.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 10, "fp": 0, "fn": 9, "recall": 0.5263 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7838, "recall": 0.4479, "f1": 0.5675, "f2": 0.4889, "f2_score": 48.9, "f3": 0.4675, "f3_score": 46.8, "tpr": 0.4479, "fpr": 0.4947, "youden_j": -0.0468, "cvss_coverage": 1.0, "cvss_tp_weight": 89.5, "cvss_fp_weight": 13.7, "cvss_fn_weight": 91.9, "cvss_precision": 0.8716, "cvss_recall": 0.4932, "cvss_f3": 0.5149, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 2, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.4062, "f1": 0.5532, "f2": 0.4545, "f2_score": 45.5, "f3": 0.429, "f3_score": 42.9, "tpr": 0.4062, "fpr": 0.3333, "youden_j": 0.0729, "cvss_coverage": 1.0, "cvss_tp_weight": 79.7, "cvss_fp_weight": 6.0, "cvss_fn_weight": 101.7, "cvss_precision": 0.9295, "cvss_recall": 0.4394, "cvss_f3": 0.4638, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-023", "file": "backend/app/seller_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 32, "fp": 8, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 1.0, "f1": 0.8889, "f2": 0.9524, "f2_score": 95.2, "f3": 0.9756, "f3_score": 97.6, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 181.4, "cvss_fp_weight": 39.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.8218, "cvss_recall": 1.0, "cvss_f3": 0.9788, "cvss_f3_score": 97.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 19, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-023", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-436", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-446", "file": "backend/app/seller_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/routers/orders.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/routers/vendors.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/routers/reviews.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/run_weekly_payouts.py", "cwe": "CWE-841" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 11, "fp": 3, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 0.3438, "f1": 0.4783, "f2": 0.3873, "f2_score": 38.7, "f3": 0.3642, "f3_score": 36.4, "tpr": 0.3438, "fpr": 0.4286, "youden_j": -0.0848, "cvss_coverage": 1.0, "cvss_tp_weight": 72.1, "cvss_fp_weight": 11.6, "cvss_fn_weight": 109.3, "cvss_precision": 0.8615, "cvss_recall": 0.3975, "cvss_f3": 0.4201, "cvss_f3_score": 42.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 15, "recall": 0.2105 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 6, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.4062, "f1": 0.5098, "f2": 0.4422, "f2_score": 44.2, "f3": 0.4235, "f3_score": 42.3, "tpr": 0.4062, "fpr": 0.6, "youden_j": -0.1937, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 33.3, "cvss_fn_weight": 98.8, "cvss_precision": 0.7128, "cvss_recall": 0.4553, "cvss_f3": 0.4724, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 13, "recall": 0.3158 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/routers/vendors.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-459" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 21, "fp": 7, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.6562, "f1": 0.7, "f2": 0.6731, "f2_score": 67.3, "f3": 0.6646, "f3_score": 66.5, "tpr": 0.6562, "fpr": 0.6364, "youden_j": 0.0199, "cvss_coverage": 1.0, "cvss_tp_weight": 123.3, "cvss_fp_weight": 28.7, "cvss_fn_weight": 58.1, "cvss_precision": 0.811, "cvss_recall": 0.6797, "cvss_f3": 0.6909, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 12, "fp": 0, "fn": 7, "recall": 0.6316 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/routers/vendors.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/routers/reviews.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 5, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7131, "recall": 0.2969, "f1": 0.4104, "f2": 0.3331, "f2_score": 33.3, "f3": 0.3138, "f3_score": 31.4, "tpr": 0.2969, "fpr": 0.4462, "youden_j": -0.1493, "cvss_coverage": 1.0, "cvss_tp_weight": 60.8, "cvss_fp_weight": 22.7, "cvss_fn_weight": 120.7, "cvss_precision": 0.7865, "cvss_recall": 0.3349, "cvss_f3": 0.3539, "cvss_f3_score": 35.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 3, "fp": 0, "fn": 16, "recall": 0.1579 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_users.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 11, "fp": 2, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8706, "recall": 0.3437, "f1": 0.4675, "f2": 0.3834, "f2_score": 38.3, "f3": 0.3624, "f3_score": 36.3, "tpr": 0.3437, "fpr": 0.2963, "youden_j": 0.0474, "cvss_coverage": 1.0, "cvss_tp_weight": 69.0, "cvss_fp_weight": 4.5, "cvss_fn_weight": 112.4, "cvss_precision": 0.9532, "cvss_recall": 0.3802, "cvss_f3": 0.4024, "cvss_f3_score": 40.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 6, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7017, "recall": 0.4166, "f1": 0.5229, "f2": 0.4535, "f2_score": 45.3, "f3": 0.4343, "f3_score": 43.4, "tpr": 0.4166, "fpr": 0.5852, "youden_j": -0.1685, "cvss_coverage": 1.0, "cvss_tp_weight": 80.8, "cvss_fp_weight": 12.9, "cvss_fn_weight": 100.6, "cvss_precision": 0.8618, "cvss_recall": 0.4454, "cvss_f3": 0.468, "cvss_f3_score": 46.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.5, "f1": 0.5926, "f2": 0.5333, "f2_score": 53.3, "f3": 0.5161, "f3_score": 51.6, "tpr": 0.5, "fpr": 0.6, "youden_j": -0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 18.1, "cvss_fn_weight": 82.0, "cvss_precision": 0.8457, "cvss_recall": 0.548, "cvss_f3": 0.568, "cvss_f3_score": 56.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 0, "fp": 1, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.2, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 2.0, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 24, "fp": 46, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3429, "recall": 0.75, "f1": 0.4706, "f2": 0.6061, "f2_score": 60.6, "f3": 0.6704, "f3_score": 67.0, "tpr": 0.75, "fpr": 0.92, "youden_j": -0.17, "cvss_coverage": 1.0, "cvss_tp_weight": 136.1, "cvss_fp_weight": 299.0, "cvss_fn_weight": 45.3, "cvss_precision": 0.3128, "cvss_recall": 0.7503, "cvss_f3": 0.6582, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 15, "fp": 0, "fn": 4, "recall": 0.7895 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/routers/vendors.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_users.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 23, "fp": 28, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.451, "recall": 0.7188, "f1": 0.5542, "f2": 0.6425, "f2_score": 64.2, "f3": 0.6785, "f3_score": 67.8, "tpr": 0.7188, "fpr": 0.9032, "youden_j": -0.1845, "cvss_coverage": 1.0, "cvss_tp_weight": 130.6, "cvss_fp_weight": 204.0, "cvss_fn_weight": 50.8, "cvss_precision": 0.3903, "cvss_recall": 0.72, "cvss_f3": 0.6639, "cvss_f3_score": 66.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 1, "precision": 0.5, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 14, "fp": 1, "fn": 5, "recall": 0.7368 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 2, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.125, "f1": 0.2105, "f2": 0.1493, "f2_score": 14.9, "f3": 0.1361, "f3_score": 13.6, "tpr": 0.125, "fpr": 0.3333, "youden_j": -0.2083, "cvss_coverage": 1.0, "cvss_tp_weight": 26.8, "cvss_fp_weight": 17.5, "cvss_fn_weight": 154.6, "cvss_precision": 0.605, "cvss_recall": 0.1477, "cvss_f3": 0.1598, "cvss_f3_score": 16.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 2, "fp": 0, "fn": 17, "recall": 0.1053 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 69, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2581, "recall": 0.75, "f1": 0.384, "f2": 0.543, "f2_score": 54.3, "f3": 0.6299, "f3_score": 63.0, "tpr": 0.75, "fpr": 0.9452, "youden_j": -0.1952, "cvss_coverage": 1.0, "cvss_tp_weight": 138.0, "cvss_fp_weight": 470.0, "cvss_fn_weight": 43.4, "cvss_precision": 0.227, "cvss_recall": 0.7607, "cvss_f3": 0.6159, "cvss_f3_score": 61.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/config.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-023", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-436", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetConfirm.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Audit.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Dashboard.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Moderation.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Payouts.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Vendors.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/DisputeDetail.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/OrderDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/support/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ApiKeys.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/Dashboard.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/DisputeDetail.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/OrderDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ProductEdit.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ProductEdit.jsx", "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 30, "fp": 11, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7317, "recall": 0.9375, "f1": 0.8219, "f2": 0.8876, "f2_score": 88.8, "f3": 0.9119, "f3_score": 91.2, "tpr": 0.9375, "fpr": 0.7333, "youden_j": 0.2042, "cvss_coverage": 1.0, "cvss_tp_weight": 170.3, "cvss_fp_weight": 85.5, "cvss_fn_weight": 11.1, "cvss_precision": 0.6658, "cvss_recall": 0.9388, "cvss_f3": 0.9018, "cvss_f3_score": 90.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.95 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "medium": { "tp": 18, "fp": 0, "fn": 1, "recall": 0.9474 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/routers/orders.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/routers/reviews.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reviews.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/routers/vendors.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-023", "file": "backend/app/seller_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-436", "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-446", "file": "backend/app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": "backend/app/storage.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api/client.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/RequireRole.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 13, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.4062, "f1": 0.4906, "f2": 0.4362, "f2_score": 43.6, "f3": 0.4207, "f3_score": 42.1, "tpr": 0.4062, "fpr": 0.6667, "youden_j": -0.2604, "cvss_coverage": 1.0, "cvss_tp_weight": 86.1, "cvss_fp_weight": 35.0, "cvss_fn_weight": 95.3, "cvss_precision": 0.711, "cvss_recall": 0.4746, "cvss_f3": 0.491, "cvss_f3_score": 49.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 24, "fp": 107, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1832, "recall": 0.75, "f1": 0.2945, "f2": 0.4633, "f2_score": 46.3, "f3": 0.5728, "f3_score": 57.3, "tpr": 0.75, "fpr": 0.964, "youden_j": -0.214, "cvss_coverage": 1.0, "cvss_tp_weight": 138.0, "cvss_fp_weight": 696.0, "cvss_fn_weight": 43.4, "cvss_precision": 0.1655, "cvss_recall": 0.7607, "cvss_f3": 0.5595, "cvss_f3_score": 55.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 13, "fp": 0, "fn": 6, "recall": 0.6842 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "backend/app/config.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin_users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/audit_view.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/categories.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payouts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reviews.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reviews.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/vendors.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-022", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-023", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-024", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-189", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-213", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-305", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-376", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-366", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-394", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-416", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-426", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-436", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetConfirm.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Audit.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Dashboard.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Moderation.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Payouts.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/admin/Vendors.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/DisputeDetail.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/buyer/OrderDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/support/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ApiKeys.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/Dashboard.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/DisputeDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/DisputeDetail.jsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/OrderDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ProductEdit.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/vendor/ProductEdit.jsx", "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 0, "fp": 9, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6923, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 49.9, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 10, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7143, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 55.5, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "rowan": { "scanner": "rowan", "tp": 4, "fp": 28, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.125, "recall": 0.125, "f1": 0.125, "f2": 0.125, "f2_score": 12.5, "f3": 0.125, "f3_score": 12.5, "tpr": 0.125, "fpr": 0.875, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 25.9, "cvss_fp_weight": 78.5, "cvss_fn_weight": 155.5, "cvss_precision": 0.2481, "cvss_recall": 0.1428, "cvss_f3": 0.1491, "cvss_f3_score": 14.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 2, "fp": 0, "fn": 17, "recall": 0.1053 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/files.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-321", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/disputes.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/storage.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/storage.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api/client.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api/client.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/context/AuthContext.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/context/AuthContext.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetConfirm.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 2, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.3333, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 11.1, "cvss_fn_weight": 181.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/backend/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-marketplace-commerce-fastapi/backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-146", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-255", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-396", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-406", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 42, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1064, "recall": 0.1562, "f1": 0.1266, "f2": 0.1429, "f2_score": 14.3, "f3": 0.1493, "f3_score": 14.9, "tpr": 0.1562, "fpr": 0.913, "youden_j": -0.7568, "cvss_coverage": 1.0, "cvss_tp_weight": 33.3, "cvss_fp_weight": 240.9, "cvss_fn_weight": 148.1, "cvss_precision": 0.1214, "cvss_recall": 0.1836, "cvss_f3": 0.1746, "cvss_f3_score": 17.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 2, "fp": 0, "fn": 17, "recall": 0.1053 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-012", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-146", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-255", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-396", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-406", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_and_isolation.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-023", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-024", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-189", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-213", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-305", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-321", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-366", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-376", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-394", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-416", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-426", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-436", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-446", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] } }, "vc-claude-code-seeded-v2-property-management-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 22, "fp": 3, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.88, "recall": 0.6667, "f1": 0.7586, "f2": 0.7006, "f2_score": 70.1, "f3": 0.6832, "f3_score": 68.3, "tpr": 0.6667, "fpr": 0.4286, "youden_j": 0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 12.9, "cvss_fn_weight": 60.0, "cvss_precision": 0.8849, "cvss_recall": 0.6236, "cvss_f3": 0.6426, "cvss_f3_score": 64.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-025", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-447", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.4242, "f1": 0.5091, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4389, "f3_score": 43.9, "tpr": 0.4242, "fpr": 0.6667, "youden_j": -0.2424, "cvss_coverage": 1.0, "cvss_tp_weight": 65.2, "cvss_fp_weight": 26.8, "cvss_fn_weight": 94.2, "cvss_precision": 0.7083, "cvss_recall": 0.409, "cvss_f3": 0.4271, "cvss_f3_score": 42.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4242, "f1": 0.5714, "f2": 0.473, "f2_score": 47.3, "f3": 0.4473, "f3_score": 44.7, "tpr": 0.4242, "fpr": 0.3333, "youden_j": 0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 63.0, "cvss_fp_weight": 4.8, "cvss_fn_weight": 96.4, "cvss_precision": 0.9291, "cvss_recall": 0.3952, "cvss_f3": 0.4193, "cvss_f3_score": 41.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 3, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8125, "recall": 0.3939, "f1": 0.5306, "f2": 0.4392, "f2_score": 43.9, "f3": 0.4153, "f3_score": 41.5, "tpr": 0.3939, "fpr": 0.4286, "youden_j": -0.0346, "cvss_coverage": 1.0, "cvss_tp_weight": 62.9, "cvss_fp_weight": 9.1, "cvss_fn_weight": 96.5, "cvss_precision": 0.8734, "cvss_recall": 0.3946, "cvss_f3": 0.4175, "cvss_f3_score": 41.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 10, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.4545, "f1": 0.5172, "f2": 0.4777, "f2_score": 47.8, "f3": 0.4658, "f3_score": 46.6, "tpr": 0.4545, "fpr": 0.7692, "youden_j": -0.3147, "cvss_coverage": 1.0, "cvss_tp_weight": 64.9, "cvss_fp_weight": 39.3, "cvss_fn_weight": 94.5, "cvss_precision": 0.623, "cvss_recall": 0.4072, "cvss_f3": 0.4218, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 1, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-025", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 1, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9166, "recall": 0.303, "f1": 0.4547, "f2": 0.3497, "f2_score": 35.0, "f3": 0.3246, "f3_score": 32.5, "tpr": 0.303, "fpr": 0.1666, "youden_j": 0.1363, "cvss_coverage": 1.0, "cvss_tp_weight": 46.1, "cvss_fp_weight": 4.3, "cvss_fn_weight": 113.3, "cvss_precision": 0.9231, "cvss_recall": 0.2893, "cvss_f3": 0.3104, "cvss_f3_score": 31.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 159.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9459, "recall": 0.3535, "f1": 0.5137, "f2": 0.4039, "f2_score": 40.4, "f3": 0.377, "f3_score": 37.7, "tpr": 0.3535, "fpr": 0.1333, "youden_j": 0.2202, "cvss_coverage": 1.0, "cvss_tp_weight": 53.6, "cvss_fp_weight": 1.6, "cvss_fn_weight": 105.8, "cvss_precision": 0.9743, "cvss_recall": 0.3365, "cvss_f3": 0.3598, "cvss_f3_score": 36.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7496, "recall": 0.4848, "f1": 0.5888, "f2": 0.5217, "f2_score": 52.2, "f3": 0.5026, "f3_score": 50.3, "tpr": 0.4848, "fpr": 0.5704, "youden_j": -0.0855, "cvss_coverage": 1.0, "cvss_tp_weight": 71.5, "cvss_fp_weight": 15.3, "cvss_fn_weight": 87.9, "cvss_precision": 0.8259, "cvss_recall": 0.4484, "cvss_f3": 0.4696, "cvss_f3_score": 47.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 12, "fp": 6, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4467, "recall": 0.3535, "f1": 0.3919, "f2": 0.3674, "f2_score": 36.7, "f3": 0.3603, "f3_score": 36.0, "tpr": 0.3535, "fpr": 0.45, "youden_j": -0.0965, "cvss_coverage": 1.0, "cvss_tp_weight": 52.9, "cvss_fp_weight": 18.2, "cvss_fn_weight": 106.5, "cvss_precision": 0.5006, "cvss_recall": 0.3319, "cvss_f3": 0.3429, "cvss_f3_score": 34.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.913, "recall": 0.6364, "f1": 0.75, "f2": 0.6774, "f2_score": 67.7, "f3": 0.6562, "f3_score": 65.6, "tpr": 0.6364, "fpr": 0.3333, "youden_j": 0.303, "cvss_coverage": 1.0, "cvss_tp_weight": 97.9, "cvss_fp_weight": 4.8, "cvss_fn_weight": 61.5, "cvss_precision": 0.9532, "cvss_recall": 0.6142, "cvss_f3": 0.6368, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-025", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7659, "recall": 0.4545, "f1": 0.5699, "f2": 0.4945, "f2_score": 49.4, "f3": 0.4737, "f3_score": 47.4, "tpr": 0.4545, "fpr": 0.5281, "youden_j": -0.0735, "cvss_coverage": 1.0, "cvss_tp_weight": 74.3, "cvss_fp_weight": 15.0, "cvss_fn_weight": 85.1, "cvss_precision": 0.8337, "cvss_recall": 0.4661, "cvss_f3": 0.4876, "cvss_f3_score": 48.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 15, "fp": 3, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.4545, "f1": 0.5882, "f2": 0.5, "f2_score": 50.0, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4545, "fpr": 0.4286, "youden_j": 0.026, "cvss_coverage": 1.0, "cvss_tp_weight": 67.5, "cvss_fp_weight": 9.1, "cvss_fn_weight": 91.9, "cvss_precision": 0.881, "cvss_recall": 0.4235, "cvss_f3": 0.4467, "cvss_f3_score": 44.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 33, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 159.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-025", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-367", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-447", "file": "backend/app/tenant_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": "backend/app/files.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": "backend/app/files.py", "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 17, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5152, "f1": 0.6538, "f2": 0.5629, "f2_score": 56.3, "f3": 0.538, "f3_score": 53.8, "tpr": 0.5152, "fpr": 0.3333, "youden_j": 0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 78.9, "cvss_fp_weight": 8.6, "cvss_fn_weight": 80.5, "cvss_precision": 0.9015, "cvss_recall": 0.495, "cvss_f3": 0.5184, "cvss_f3_score": 51.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 2, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4848, "f1": 0.6275, "f2": 0.5333, "f2_score": 53.3, "f3": 0.5079, "f3_score": 50.8, "tpr": 0.4848, "fpr": 0.3333, "youden_j": 0.1515, "cvss_coverage": 1.0, "cvss_tp_weight": 83.6, "cvss_fp_weight": 8.6, "cvss_fn_weight": 75.8, "cvss_precision": 0.9066, "cvss_recall": 0.5245, "cvss_f3": 0.5475, "cvss_f3_score": 54.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 3, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 1.0, "f1": 0.9565, "f2": 0.9821, "f2_score": 98.2, "f3": 0.991, "f3_score": 99.1, "tpr": 1.0, "fpr": 0.4286, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 159.4, "cvss_fp_weight": 12.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.925, "cvss_recall": 1.0, "cvss_f3": 0.992, "cvss_f3_score": 99.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": "backend/app/files.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": "backend/app/files.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-025", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-367", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-447", "file": "backend/app/tenant_operations.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 1, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8818, "recall": 0.303, "f1": 0.449, "f2": 0.3482, "f2_score": 34.8, "f3": 0.324, "f3_score": 32.4, "tpr": 0.303, "fpr": 0.2444, "youden_j": 0.0586, "cvss_coverage": 1.0, "cvss_tp_weight": 46.9, "cvss_fp_weight": 3.2, "cvss_fn_weight": 112.5, "cvss_precision": 0.9324, "cvss_recall": 0.2945, "cvss_f3": 0.3159, "cvss_f3_score": 31.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7684, "recall": 0.4545, "f1": 0.5712, "f2": 0.495, "f2_score": 49.5, "f3": 0.4738, "f3_score": 47.4, "tpr": 0.4545, "fpr": 0.5278, "youden_j": -0.0732, "cvss_coverage": 1.0, "cvss_tp_weight": 71.3, "cvss_fp_weight": 11.8, "cvss_fn_weight": 88.1, "cvss_precision": 0.8575, "cvss_recall": 0.4473, "cvss_f3": 0.4698, "cvss_f3_score": 47.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7229, "recall": 0.4747, "f1": 0.5719, "f2": 0.5092, "f2_score": 50.9, "f3": 0.4913, "f3_score": 49.1, "tpr": 0.4747, "fpr": 0.5973, "youden_j": -0.1225, "cvss_coverage": 1.0, "cvss_tp_weight": 73.9, "cvss_fp_weight": 9.3, "cvss_fn_weight": 85.5, "cvss_precision": 0.8878, "cvss_recall": 0.4636, "cvss_f3": 0.4867, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8095, "recall": 0.5152, "f1": 0.6296, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5346, "f3_score": 53.5, "tpr": 0.5152, "fpr": 0.5, "youden_j": 0.0152, "cvss_coverage": 1.0, "cvss_tp_weight": 75.5, "cvss_fp_weight": 5.8, "cvss_fn_weight": 83.9, "cvss_precision": 0.9286, "cvss_recall": 0.4737, "cvss_f3": 0.4981, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 17, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5152, "f1": 0.6538, "f2": 0.5629, "f2_score": 56.3, "f3": 0.538, "f3_score": 53.8, "tpr": 0.5152, "fpr": 0.3333, "youden_j": 0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 80.5, "cvss_fp_weight": 7.5, "cvss_fn_weight": 78.9, "cvss_precision": 0.9148, "cvss_recall": 0.505, "cvss_f3": 0.5287, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 27, "fp": 42, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3913, "recall": 0.8182, "f1": 0.5294, "f2": 0.6716, "f2_score": 67.2, "f3": 0.7377, "f3_score": 73.8, "tpr": 0.8182, "fpr": 0.913, "youden_j": -0.0949, "cvss_coverage": 1.0, "cvss_tp_weight": 131.2, "cvss_fp_weight": 253.0, "cvss_fn_weight": 28.2, "cvss_precision": 0.3415, "cvss_recall": 0.8231, "cvss_f3": 0.7214, "cvss_f3_score": 72.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 3, "recall": 0.8235 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": "backend/app/files.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/.env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": "backend/app/files.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 25, "fp": 25, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7576, "f1": 0.6024, "f2": 0.6868, "f2_score": 68.7, "f3": 0.7205, "f3_score": 72.0, "tpr": 0.7576, "fpr": 0.8929, "youden_j": -0.1353, "cvss_coverage": 1.0, "cvss_tp_weight": 122.7, "cvss_fp_weight": 153.5, "cvss_fn_weight": 36.7, "cvss_precision": 0.4442, "cvss_recall": 0.7698, "cvss_f3": 0.7172, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 1, "fn": 5, "precision": 0.9231, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 1, "fn": 4, "recall": 0.7647 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-367", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routes/tickets.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": "backend/app/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 2, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.0303, "f1": 0.0556, "f2": 0.037, "f2_score": 3.7, "f3": 0.0333, "f3_score": 3.3, "tpr": 0.0303, "fpr": 0.3333, "youden_j": -0.303, "cvss_coverage": 1.0, "cvss_tp_weight": 4.9, "cvss_fp_weight": 16.0, "cvss_fn_weight": 154.5, "cvss_precision": 0.2344, "cvss_recall": 0.0307, "cvss_f3": 0.0337, "cvss_f3_score": 3.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 16, "recall": 0.0588 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 66, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.7273, "f1": 0.3902, "f2": 0.5405, "f2_score": 54.1, "f3": 0.6202, "f3_score": 62.0, "tpr": 0.7273, "fpr": 0.9565, "youden_j": -0.2292, "cvss_coverage": 1.0, "cvss_tp_weight": 115.2, "cvss_fp_weight": 417.0, "cvss_fn_weight": 44.2, "cvss_precision": 0.2165, "cvss_recall": 0.7227, "cvss_f3": 0.5857, "cvss_f3_score": 58.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/files.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-331" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-784" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetComplete.jsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Tenants.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 13, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.675, "recall": 0.8182, "f1": 0.7397, "f2": 0.7849, "f2_score": 78.5, "f3": 0.8012, "f3_score": 80.1, "tpr": 0.8182, "fpr": 0.7647, "youden_j": 0.0535, "cvss_coverage": 1.0, "cvss_tp_weight": 126.7, "cvss_fp_weight": 101.5, "cvss_fn_weight": 32.7, "cvss_precision": 0.5552, "cvss_recall": 0.7949, "cvss_f3": 0.762, "cvss_f3_score": 76.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8235 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": "backend/app/files.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-367", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-447", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Documents.jsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/LeaseDetail.jsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetComplete.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 8, "fp": 9, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 0.2424, "f1": 0.32, "f2": 0.2685, "f2_score": 26.8, "f3": 0.2548, "f3_score": 25.5, "tpr": 0.2424, "fpr": 0.6923, "youden_j": -0.4499, "cvss_coverage": 1.0, "cvss_tp_weight": 44.8, "cvss_fp_weight": 44.0, "cvss_fn_weight": 114.6, "cvss_precision": 0.5045, "cvss_recall": 0.2811, "cvss_f3": 0.2941, "cvss_f3_score": 29.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 24, "fp": 106, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1846, "recall": 0.7273, "f1": 0.2945, "f2": 0.458, "f2_score": 45.8, "f3": 0.5621, "f3_score": 56.2, "tpr": 0.7273, "fpr": 0.9725, "youden_j": -0.2452, "cvss_coverage": 1.0, "cvss_tp_weight": 115.2, "cvss_fp_weight": 642.5, "cvss_fn_weight": 44.2, "cvss_precision": 0.152, "cvss_recall": 0.7227, "cvss_f3": 0.5255, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/files.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/imports_exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tenants.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-026", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-190", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-306", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-347", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-331" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-417", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-437", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-784" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetComplete.jsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Tenants.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Users.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 0, "fp": 13, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7647, "youden_j": -0.7647, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 56.0, "cvss_fn_weight": 159.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 159.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 5, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.1515, "f1": 0.2632, "f2": 0.1825, "f2_score": 18.2, "f3": 0.1656, "f3_score": 16.6, "tpr": 0.1515, "fpr": 0.0, "youden_j": 0.1515, "cvss_coverage": 1.0, "cvss_tp_weight": 27.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 132.1, "cvss_precision": 1.0, "cvss_recall": 0.1713, "cvss_f3": 0.1867, "cvss_f3_score": 18.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-386", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 11, "fp": 42, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2075, "recall": 0.3333, "f1": 0.2558, "f2": 0.2973, "f2_score": 29.7, "f3": 0.3143, "f3_score": 31.4, "tpr": 0.3333, "fpr": 0.9333, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 53.1, "cvss_fp_weight": 182.0, "cvss_fn_weight": 106.3, "cvss_precision": 0.2259, "cvss_recall": 0.3331, "cvss_f3": 0.318, "cvss_f3_score": 31.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 1, "fn": 2, "precision": 0.75, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-377", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-214", "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routes/leases.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/leases.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routes/payments.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/payments.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tenants.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routes/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Documents.jsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/LeaseDetail.jsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/files.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/files.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetComplete.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ResetRequest.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 4, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.5, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 13.4, "cvss_fn_weight": 159.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-property-management-fastapi/backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-147", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-271", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-397", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-407", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-427", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 30, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1892, "recall": 0.2121, "f1": 0.2, "f2": 0.2071, "f2_score": 20.7, "f3": 0.2096, "f3_score": 21.0, "tpr": 0.2121, "fpr": 0.8824, "youden_j": -0.6702, "cvss_coverage": 1.0, "cvss_tp_weight": 23.8, "cvss_fp_weight": 144.8, "cvss_fn_weight": 135.6, "cvss_precision": 0.1411, "cvss_recall": 0.1493, "cvss_f3": 0.1485, "cvss_f3_score": 14.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-027", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-147", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-271", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-397", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-407", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-427", "file": "backend/app/tenant_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-190", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-214", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-306", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-347", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-367", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-377", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-386", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-417", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-437", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-447", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-property-management-fastapi-enrich-015", "file": null, "cwe": "CWE-312" } ] } }, "vc-claude-code-seeded-v2-support-desk-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 22, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8462, "recall": 0.6471, "f1": 0.7333, "f2": 0.679, "f2_score": 67.9, "f3": 0.6627, "f3_score": 66.3, "tpr": 0.6471, "fpr": 0.5, "youden_j": 0.1471, "cvss_coverage": 1.0, "cvss_tp_weight": 133.8, "cvss_fp_weight": 16.7, "cvss_fn_weight": 70.8, "cvss_precision": 0.8893, "cvss_recall": 0.654, "cvss_f3": 0.6717, "cvss_f3_score": 67.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 12, "fp": 0, "fn": 8, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-448", "file": "backend/app/support_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/public_api.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4706, "f1": 0.6154, "f2": 0.5195, "f2_score": 51.9, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.4706, "fpr": 0.3333, "youden_j": 0.1373, "cvss_coverage": 1.0, "cvss_tp_weight": 105.6, "cvss_fp_weight": 5.9, "cvss_fn_weight": 99.0, "cvss_precision": 0.9472, "cvss_recall": 0.5161, "cvss_f3": 0.5407, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9412, "recall": 0.4706, "f1": 0.6275, "f2": 0.5229, "f2_score": 52.3, "f3": 0.4954, "f3_score": 49.5, "tpr": 0.4706, "fpr": 0.2, "youden_j": 0.2706, "cvss_coverage": 1.0, "cvss_tp_weight": 104.5, "cvss_fp_weight": 5.4, "cvss_fn_weight": 100.1, "cvss_precision": 0.951, "cvss_recall": 0.5108, "cvss_f3": 0.5355, "cvss_f3_score": 53.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 7, "fp": 0, "fn": 13, "recall": 0.35 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.4706, "f1": 0.5818, "f2": 0.5096, "f2_score": 51.0, "f3": 0.4893, "f3_score": 48.9, "tpr": 0.4706, "fpr": 0.5556, "youden_j": -0.085, "cvss_coverage": 1.0, "cvss_tp_weight": 103.4, "cvss_fp_weight": 7.4, "cvss_fn_weight": 101.2, "cvss_precision": 0.9333, "cvss_recall": 0.5054, "cvss_f3": 0.5297, "cvss_f3_score": 53.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4706, "f1": 0.5517, "f2": 0.5, "f2_score": 50.0, "f3": 0.4848, "f3_score": 48.5, "tpr": 0.4706, "fpr": 0.6667, "youden_j": -0.1961, "cvss_coverage": 1.0, "cvss_tp_weight": 97.9, "cvss_fp_weight": 38.2, "cvss_fn_weight": 106.7, "cvss_precision": 0.7194, "cvss_recall": 0.4785, "cvss_f3": 0.4951, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 10, "fp": 0, "fn": 10, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 12, "fp": 1, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9556, "recall": 0.3431, "f1": 0.5023, "f2": 0.3928, "f2_score": 39.2, "f3": 0.3663, "f3_score": 36.6, "tpr": 0.3431, "fpr": 0.1111, "youden_j": 0.232, "cvss_coverage": 1.0, "cvss_tp_weight": 75.2, "cvss_fp_weight": 0.3, "cvss_fn_weight": 129.4, "cvss_precision": 0.9961, "cvss_recall": 0.3676, "cvss_f3": 0.3921, "cvss_f3_score": 39.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 13, "recall": 0.35 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 1, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.2941, "f1": 0.4444, "f2": 0.3401, "f2_score": 34.0, "f3": 0.3155, "f3_score": 31.5, "tpr": 0.2941, "fpr": 0.2, "youden_j": 0.0941, "cvss_coverage": 1.0, "cvss_tp_weight": 69.9, "cvss_fp_weight": 0.5, "cvss_fn_weight": 134.7, "cvss_precision": 0.9929, "cvss_recall": 0.3416, "cvss_f3": 0.3656, "cvss_f3_score": 36.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 4, "fp": 0, "fn": 16, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 204.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 204.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 204.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 20, "fp": 9, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.5882, "f1": 0.6349, "f2": 0.6061, "f2_score": 60.6, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5882, "fpr": 0.6923, "youden_j": -0.1041, "cvss_coverage": 1.0, "cvss_tp_weight": 123.2, "cvss_fp_weight": 38.7, "cvss_fn_weight": 81.4, "cvss_precision": 0.761, "cvss_recall": 0.6022, "cvss_f3": 0.615, "cvss_f3_score": 61.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 12, "fp": 0, "fn": 8, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7916, "recall": 0.5294, "f1": 0.6319, "f2": 0.5658, "f2_score": 56.6, "f3": 0.547, "f3_score": 54.7, "tpr": 0.5294, "fpr": 0.5232, "youden_j": 0.0062, "cvss_coverage": 1.0, "cvss_tp_weight": 114.2, "cvss_fp_weight": 20.4, "cvss_fn_weight": 90.4, "cvss_precision": 0.8552, "cvss_recall": 0.5582, "cvss_f3": 0.5779, "cvss_f3_score": 57.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 10, "fp": 0, "fn": 10, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4706, "f1": 0.6154, "f2": 0.5195, "f2_score": 51.9, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.4706, "fpr": 0.3333, "youden_j": 0.1373, "cvss_coverage": 1.0, "cvss_tp_weight": 106.6, "cvss_fp_weight": 5.9, "cvss_fn_weight": 98.0, "cvss_precision": 0.9477, "cvss_recall": 0.521, "cvss_f3": 0.5456, "cvss_f3_score": 54.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 9, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7353, "recall": 0.7353, "f1": 0.7353, "f2": 0.7353, "f2_score": 73.5, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.7353, "fpr": 0.6923, "youden_j": 0.043, "cvss_coverage": 1.0, "cvss_tp_weight": 152.1, "cvss_fp_weight": 43.6, "cvss_fn_weight": 52.5, "cvss_precision": 0.7773, "cvss_recall": 0.7434, "cvss_f3": 0.7467, "cvss_f3_score": 74.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.65 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 14, "fp": 0, "fn": 6, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/attachments.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/cli.py", "cwe": "CWE-214" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 20, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5882, "f1": 0.6897, "f2": 0.625, "f2_score": 62.5, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.5882, "fpr": 0.5, "youden_j": 0.0882, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 21.5, "cvss_fn_weight": 83.1, "cvss_precision": 0.8494, "cvss_recall": 0.5938, "cvss_f3": 0.6123, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.45 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 6, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.4706, "f1": 0.5714, "f2": 0.5063, "f2_score": 50.6, "f3": 0.4878, "f3_score": 48.8, "tpr": 0.4706, "fpr": 0.6, "youden_j": -0.1294, "cvss_coverage": 1.0, "cvss_tp_weight": 104.2, "cvss_fp_weight": 27.4, "cvss_fn_weight": 100.4, "cvss_precision": 0.7917, "cvss_recall": 0.5093, "cvss_f3": 0.5281, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 12, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/deps.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/attachments.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 34, "fp": 2, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 1.0, "f1": 0.9714, "f2": 0.9884, "f2_score": 98.8, "f3": 0.9942, "f3_score": 99.4, "tpr": 1.0, "fpr": 0.3333, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 204.6, "cvss_fp_weight": 10.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.95, "cvss_recall": 1.0, "cvss_f3": 0.9948, "cvss_f3_score": 99.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 20, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": "backend/app/routers/attachments.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": "backend/app/routers/attachments.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/public_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-448", "file": "backend/app/support_operations.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.963, "recall": 0.3922, "f1": 0.5487, "f2": 0.4422, "f2_score": 44.2, "f3": 0.4156, "f3_score": 41.6, "tpr": 0.3922, "fpr": 0.1111, "youden_j": 0.2811, "cvss_coverage": 1.0, "cvss_tp_weight": 87.5, "cvss_fp_weight": 2.0, "cvss_fn_weight": 117.1, "cvss_precision": 0.9821, "cvss_recall": 0.4278, "cvss_f3": 0.4525, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 9, "fp": 0, "fn": 11, "recall": 0.45 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-311" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 4, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8029, "recall": 0.3922, "f1": 0.5208, "f2": 0.4346, "f2_score": 43.5, "f3": 0.4122, "f3_score": 41.2, "tpr": 0.3922, "fpr": 0.4333, "youden_j": -0.0412, "cvss_coverage": 1.0, "cvss_tp_weight": 87.5, "cvss_fp_weight": 11.6, "cvss_fn_weight": 117.1, "cvss_precision": 0.8876, "cvss_recall": 0.4275, "cvss_f3": 0.4505, "cvss_f3_score": 45.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 5, "fp": 0, "fn": 15, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 6, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7226, "recall": 0.451, "f1": 0.5535, "f2": 0.4868, "f2_score": 48.7, "f3": 0.4682, "f3_score": 46.8, "tpr": 0.451, "fpr": 0.5909, "youden_j": -0.1399, "cvss_coverage": 1.0, "cvss_tp_weight": 100.4, "cvss_fp_weight": 11.1, "cvss_fn_weight": 104.2, "cvss_precision": 0.901, "cvss_recall": 0.4909, "cvss_f3": 0.5143, "cvss_f3_score": 51.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5882, "f1": 0.6897, "f2": 0.625, "f2_score": 62.5, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.5882, "fpr": 0.5, "youden_j": 0.0882, "cvss_coverage": 1.0, "cvss_tp_weight": 125.4, "cvss_fp_weight": 6.9, "cvss_fn_weight": 79.2, "cvss_precision": 0.948, "cvss_recall": 0.6129, "cvss_f3": 0.6354, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.45 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 11, "fp": 0, "fn": 9, "recall": 0.55 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 2, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4706, "f1": 0.6154, "f2": 0.5195, "f2_score": 51.9, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.4706, "fpr": 0.4, "youden_j": 0.0706, "cvss_coverage": 1.0, "cvss_tp_weight": 103.4, "cvss_fp_weight": 17.5, "cvss_fn_weight": 101.2, "cvss_precision": 0.8553, "cvss_recall": 0.5054, "cvss_f3": 0.5269, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 9, "fp": 1, "fn": 11, "recall": 0.45 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 25, "fp": 41, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3788, "recall": 0.7353, "f1": 0.5, "f2": 0.6188, "f2_score": 61.9, "f3": 0.672, "f3_score": 67.2, "tpr": 0.7353, "fpr": 0.9111, "youden_j": -0.1758, "cvss_coverage": 1.0, "cvss_tp_weight": 149.2, "cvss_fp_weight": 254.5, "cvss_fn_weight": 55.4, "cvss_precision": 0.3696, "cvss_recall": 0.7292, "cvss_f3": 0.6646, "cvss_f3_score": 66.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 15, "fp": 0, "fn": 5, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/cli.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": "backend/app/routers/attachments.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 28, "fp": 20, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.8235, "f1": 0.6829, "f2": 0.7609, "f2_score": 76.1, "f3": 0.791, "f3_score": 79.1, "tpr": 0.8235, "fpr": 0.8333, "youden_j": -0.0098, "cvss_coverage": 1.0, "cvss_tp_weight": 170.4, "cvss_fp_weight": 124.5, "cvss_fn_weight": 34.2, "cvss_precision": 0.5778, "cvss_recall": 0.8328, "cvss_f3": 0.7976, "cvss_f3_score": 79.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 16, "fp": 0, "fn": 4, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/public_api.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": "backend/app/routers/attachments.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 1, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.1176, "f1": 0.2051, "f2": 0.1418, "f2_score": 14.2, "f3": 0.1286, "f3_score": 12.9, "tpr": 0.1176, "fpr": 0.2, "youden_j": -0.0824, "cvss_coverage": 1.0, "cvss_tp_weight": 33.3, "cvss_fp_weight": 8.0, "cvss_fn_weight": 171.3, "cvss_precision": 0.8063, "cvss_recall": 0.1628, "cvss_f3": 0.1769, "cvss_f3_score": 17.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 1, "fp": 0, "fn": 19, "recall": 0.05 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 28, "fp": 83, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2523, "recall": 0.8235, "f1": 0.3862, "f2": 0.5668, "f2_score": 56.7, "f3": 0.6715, "f3_score": 67.1, "tpr": 0.8235, "fpr": 0.954, "youden_j": -0.1305, "cvss_coverage": 1.0, "cvss_tp_weight": 170.4, "cvss_fp_weight": 558.0, "cvss_fn_weight": 34.2, "cvss_precision": 0.2339, "cvss_recall": 0.8328, "cvss_f3": 0.6631, "cvss_f3_score": 66.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 16, "fp": 0, "fn": 4, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/cli.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/attachments.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/public_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/text.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/conftest.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBPublicArticle.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordResetConfirm.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/utils.js", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 26, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4902, "recall": 0.7353, "f1": 0.5882, "f2": 0.6684, "f2_score": 66.8, "f3": 0.7003, "f3_score": 70.0, "tpr": 0.7353, "fpr": 0.8667, "youden_j": -0.1314, "cvss_coverage": 1.0, "cvss_tp_weight": 150.9, "cvss_fp_weight": 198.0, "cvss_fn_weight": 53.7, "cvss_precision": 0.4325, "cvss_recall": 0.7375, "cvss_f3": 0.6889, "cvss_f3_score": 68.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 16, "fp": 0, "fn": 4, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-448", "file": "backend/app/support_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/auth.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminAudit.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminImports.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminOrganizations.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminOrganizations.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminUsers.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminUsers.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBEditor.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/SLAReports.jsx", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 19, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.525, "recall": 0.6176, "f1": 0.5676, "f2": 0.5966, "f2_score": 59.7, "f3": 0.6069, "f3_score": 60.7, "tpr": 0.6176, "fpr": 0.8261, "youden_j": -0.2084, "cvss_coverage": 1.0, "cvss_tp_weight": 125.6, "cvss_fp_weight": 117.0, "cvss_fn_weight": 79.0, "cvss_precision": 0.5177, "cvss_recall": 0.6139, "cvss_f3": 0.6027, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 13, "fp": 0, "fn": 7, "recall": 0.65 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 28, "fp": 93, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2314, "recall": 0.8235, "f1": 0.3613, "f2": 0.5447, "f2_score": 54.5, "f3": 0.6557, "f3_score": 65.6, "tpr": 0.8235, "fpr": 0.9588, "youden_j": -0.1352, "cvss_coverage": 1.0, "cvss_tp_weight": 170.4, "cvss_fp_weight": 625.5, "cvss_fn_weight": 34.2, "cvss_precision": 0.2141, "cvss_recall": 0.8328, "cvss_f3": 0.6461, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 16, "fp": 0, "fn": 4, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/cli.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": "backend/app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/attachments.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/routers/auth.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/organizations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/public_api.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/public_api.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/tickets.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/text.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-029", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-030", "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-232", "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-307", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-438", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/conftest.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBPublicArticle.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/PasswordResetConfirm.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TicketList.jsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/utils.js", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 6, "fp": 5, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5381, "recall": 0.1863, "f1": 0.2753, "f2": 0.2138, "f2_score": 21.4, "f3": 0.1991, "f3_score": 19.9, "tpr": 0.1863, "fpr": 0.4778, "youden_j": -0.2915, "cvss_coverage": 1.0, "cvss_tp_weight": 43.4, "cvss_fp_weight": 28.7, "cvss_fn_weight": 161.2, "cvss_precision": 0.5603, "cvss_recall": 0.212, "cvss_f3": 0.2258, "cvss_f3_score": 22.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 204.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 4, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.3235, "f1": 0.449, "f2": 0.3642, "f2_score": 36.4, "f3": 0.3427, "f3_score": 34.3, "tpr": 0.3235, "fpr": 0.5, "youden_j": -0.1765, "cvss_coverage": 1.0, "cvss_tp_weight": 67.0, "cvss_fp_weight": 16.7, "cvss_fn_weight": 137.6, "cvss_precision": 0.8009, "cvss_recall": 0.3275, "cvss_f3": 0.348, "cvss_f3_score": 34.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 14, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-418", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-387", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-368", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhooks.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 33, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1951, "recall": 0.2353, "f1": 0.2133, "f2": 0.226, "f2_score": 22.6, "f3": 0.2305, "f3_score": 23.1, "tpr": 0.2353, "fpr": 0.8919, "youden_j": -0.6566, "cvss_coverage": 1.0, "cvss_tp_weight": 53.7, "cvss_fp_weight": 155.0, "cvss_fn_weight": 150.9, "cvss_precision": 0.2573, "cvss_recall": 0.2625, "cvss_f3": 0.2619, "cvss_f3_score": 26.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 4, "fp": 0, "fn": 16, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-378", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-210", "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/escalations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/organizations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/conftest.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_boundaries.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBPublicArticle.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBPublicArticle.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/utils.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 4, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.5, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 21.5, "cvss_fn_weight": 204.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 20, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-claude-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-028", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-148", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-272", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-354", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-398", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-408", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-428", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 8, "fp": 38, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1739, "recall": 0.2353, "f1": 0.2, "f2": 0.2198, "f2_score": 22.0, "f3": 0.2273, "f3_score": 22.7, "tpr": 0.2353, "fpr": 0.9048, "youden_j": -0.6695, "cvss_coverage": 1.0, "cvss_tp_weight": 48.5, "cvss_fp_weight": 216.9, "cvss_fn_weight": 156.1, "cvss_precision": 0.1827, "cvss_recall": 0.237, "cvss_f3": 0.2302, "cvss_f3_score": 23.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 5, "fp": 0, "fn": 15, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-028", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-148", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-272", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-354", "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-398", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-408", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-428", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/KBPublicArticle.jsx", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-030", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-210", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-232", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-307", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-368", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-378", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-387", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-418", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-438", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-448", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-014", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v2-support-desk-fastapi-enrich-016", "file": null, "cwe": "CWE-312" } ] } }, "vc-claude-code-seeded-v3-crm-saas-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 13, "fp": 10, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5652, "recall": 0.2653, "f1": 0.3611, "f2": 0.2968, "f2_score": 29.7, "f3": 0.2802, "f3_score": 28.0, "tpr": 0.2653, "fpr": 1.0, "youden_j": -0.7347, "cvss_coverage": 1.0, "cvss_tp_weight": 89.9, "cvss_fp_weight": 66.3, "cvss_fn_weight": 234.8, "cvss_precision": 0.5757, "cvss_recall": 0.2769, "cvss_f3": 0.292, "cvss_f3_score": 29.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 35, "recall": 0.2708 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 18, "fp": 10, "fn": 31, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.3673, "f1": 0.4675, "f2": 0.4018, "f2_score": 40.2, "f3": 0.3838, "f3_score": 38.4, "tpr": 0.3673, "fpr": 1.0, "youden_j": -0.6327, "cvss_coverage": 1.0, "cvss_tp_weight": 127.9, "cvss_fp_weight": 54.0, "cvss_fn_weight": 196.8, "cvss_precision": 0.7031, "cvss_recall": 0.3939, "cvss_f3": 0.412, "cvss_f3_score": 41.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 30, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 13, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5667, "recall": 0.3469, "f1": 0.4304, "f2": 0.3761, "f2_score": 37.6, "f3": 0.3609, "f3_score": 36.1, "tpr": 0.3469, "fpr": 1.0, "youden_j": -0.6531, "cvss_coverage": 1.0, "cvss_tp_weight": 117.5, "cvss_fp_weight": 80.0, "cvss_fn_weight": 207.2, "cvss_precision": 0.5949, "cvss_recall": 0.3619, "cvss_f3": 0.3766, "cvss_f3_score": 37.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 31, "recall": 0.3542 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-80" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 23, "fp": 9, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7188, "recall": 0.4694, "f1": 0.5679, "f2": 0.5044, "f2_score": 50.4, "f3": 0.4863, "f3_score": 48.6, "tpr": 0.4694, "fpr": 1.0, "youden_j": -0.5306, "cvss_coverage": 1.0, "cvss_tp_weight": 157.4, "cvss_fp_weight": 59.6, "cvss_fn_weight": 167.3, "cvss_precision": 0.7252, "cvss_recall": 0.4848, "cvss_f3": 0.5014, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 25, "recall": 0.4792 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/pinned-accounts-cookie.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 24, "fp": 22, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5217, "recall": 0.4898, "f1": 0.5053, "f2": 0.4959, "f2_score": 49.6, "f3": 0.4928, "f3_score": 49.3, "tpr": 0.4898, "fpr": 1.0, "youden_j": -0.5102, "cvss_coverage": 1.0, "cvss_tp_weight": 171.2, "cvss_fp_weight": 127.4, "cvss_fn_weight": 153.5, "cvss_precision": 0.5733, "cvss_recall": 0.5273, "cvss_f3": 0.5315, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 24, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/pages/auth/login.component.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database/data-source-options.ts", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 42, "fp": 14, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.8571, "f1": 0.8, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8451, "f3_score": 84.5, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 284.7, "cvss_fp_weight": 92.8, "cvss_fn_weight": 40.0, "cvss_precision": 0.7542, "cvss_recall": 0.8768, "cvss_f3": 0.8628, "cvss_f3_score": 86.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 42, "fp": 0, "fn": 6, "recall": 0.875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 26, "fp": 26, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5306, "f1": 0.5149, "f2": 0.5242, "f2_score": 52.4, "f3": 0.5274, "f3_score": 52.7, "tpr": 0.5306, "fpr": 1.0, "youden_j": -0.4694, "cvss_coverage": 1.0, "cvss_tp_weight": 174.0, "cvss_fp_weight": 172.3, "cvss_fn_weight": 150.7, "cvss_precision": 0.5025, "cvss_recall": 0.5359, "cvss_f3": 0.5323, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 22, "recall": 0.5417 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/organizations/pinned-accounts-cookie.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/pages/organizations/organization-detail.component.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 49, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 324.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 24, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 48, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/organizations/pinned-accounts-cookie.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 47, "fp": 27, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6351, "recall": 0.9592, "f1": 0.7642, "f2": 0.8704, "f2_score": 87.0, "f3": 0.9126, "f3_score": 91.3, "tpr": 0.9592, "fpr": 1.0, "youden_j": -0.0408, "cvss_coverage": 1.0, "cvss_tp_weight": 313.9, "cvss_fp_weight": 190.0, "cvss_fn_weight": 10.8, "cvss_precision": 0.6229, "cvss_recall": 0.9667, "cvss_f3": 0.9162, "cvss_f3_score": 91.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9583 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 47, "fp": 0, "fn": 1, "recall": 0.9792 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/common/object-merge.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/portal-session.store.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.module.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/escalations/queue-layout-cookie.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/organizations/pinned-accounts-cookie.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 16, "fn": 45, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.0816, "f1": 0.1159, "f2": 0.0926, "f2_score": 9.3, "f3": 0.0868, "f3_score": 8.7, "tpr": 0.0816, "fpr": 1.0, "youden_j": -0.9184, "cvss_coverage": 1.0, "cvss_tp_weight": 28.3, "cvss_fp_weight": 63.1, "cvss_fn_weight": 296.4, "cvss_precision": 0.3095, "cvss_recall": 0.0872, "cvss_f3": 0.0939, "cvss_f3_score": 9.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.0417 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 44, "recall": 0.0833 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.controller.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/digest-mute-cookie.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-047", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-education-lms-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 13, "fp": 23, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3611, "recall": 0.3421, "f1": 0.3514, "f2": 0.3457, "f2_score": 34.6, "f3": 0.3439, "f3_score": 34.4, "tpr": 0.3421, "fpr": 1.0, "youden_j": -0.6579, "cvss_coverage": 1.0, "cvss_tp_weight": 88.0, "cvss_fp_weight": 146.9, "cvss_fn_weight": 154.7, "cvss_precision": 0.3746, "cvss_recall": 0.3626, "cvss_f3": 0.3638, "cvss_f3_score": 36.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 25, "recall": 0.3421 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/embed/route.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/discussions/digest/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/notificationDigestPrefs.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-613" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 40, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2982, "recall": 0.4474, "f1": 0.3579, "f2": 0.4067, "f2_score": 40.7, "f3": 0.4261, "f3_score": 42.6, "tpr": 0.4474, "fpr": 1.0, "youden_j": -0.5526, "cvss_coverage": 1.0, "cvss_tp_weight": 108.5, "cvss_fp_weight": 173.1, "cvss_fn_weight": 134.2, "cvss_precision": 0.3854, "cvss_recall": 0.4471, "cvss_f3": 0.44, "cvss_f3_score": 44.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 21, "recall": 0.4474 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/staff-summary/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/staff-summary/route.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/print/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/print/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/embed/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/embed/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/discussions/digest/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/discussions/digest/route.ts", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointDraftCipher.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/reopen-request/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/withdraw-request/route.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 19, "fp": 26, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4222, "recall": 0.5, "f1": 0.4578, "f2": 0.4822, "f2_score": 48.2, "f3": 0.491, "f3_score": 49.1, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 123.2, "cvss_fp_weight": 130.7, "cvss_fn_weight": 119.5, "cvss_precision": 0.4852, "cvss_recall": 0.5076, "cvss_f3": 0.5053, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 19, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/ltiLaunch.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/discussions/digest/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/notificationDigestPrefs.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 27, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4255, "recall": 0.5263, "f1": 0.4706, "f2": 0.5025, "f2_score": 50.3, "f3": 0.5141, "f3_score": 51.4, "tpr": 0.5263, "fpr": 1.0, "youden_j": -0.4737, "cvss_coverage": 1.0, "cvss_tp_weight": 131.7, "cvss_fp_weight": 160.7, "cvss_fn_weight": 111.0, "cvss_precision": 0.4505, "cvss_recall": 0.5426, "cvss_f3": 0.5318, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 18, "recall": 0.5263 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/notificationDigestPrefs.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/hardwareFeedPrivileges.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/ltiLaunch.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/discussions/digest/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/discussions.ts", "cwe": "CWE-1426" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-434" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 24, "fp": 45, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3478, "recall": 0.6316, "f1": 0.4486, "f2": 0.543, "f2_score": 54.3, "f3": 0.5839, "f3_score": 58.4, "tpr": 0.6316, "fpr": 1.0, "youden_j": -0.3684, "cvss_coverage": 1.0, "cvss_tp_weight": 152.2, "cvss_fp_weight": 258.0, "cvss_fn_weight": 90.5, "cvss_precision": 0.3711, "cvss_recall": 0.6271, "cvss_f3": 0.5866, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 14, "recall": 0.6316 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/ltiLaunch.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/ltiLaunch.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/account.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/notificationDigestPrefs.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/catalog/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/guardian-portal/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/hardwareFeedPrivileges.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/hardwareFeedPrivileges.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": "src/actions/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/discussions.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/certificates/embed/route.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 33, "fp": 25, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.569, "recall": 0.8684, "f1": 0.6875, "f2": 0.7857, "f2_score": 78.6, "f3": 0.825, "f3_score": 82.5, "tpr": 0.8684, "fpr": 1.0, "youden_j": -0.1316, "cvss_coverage": 1.0, "cvss_tp_weight": 214.8, "cvss_fp_weight": 159.7, "cvss_fn_weight": 27.9, "cvss_precision": 0.5736, "cvss_recall": 0.885, "cvss_f3": 0.8395, "cvss_f3_score": 83.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 5, "recall": 0.8684 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": "src/actions/account.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": "src/actions/courses.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": "src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/reopen-request/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/staff-summary/route.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/hardwareFeedPrivileges.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 25, "fp": 34, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4237, "recall": 0.6579, "f1": 0.5155, "f2": 0.5924, "f2_score": 59.2, "f3": 0.6234, "f3_score": 62.3, "tpr": 0.6579, "fpr": 1.0, "youden_j": -0.3421, "cvss_coverage": 1.0, "cvss_tp_weight": 160.8, "cvss_fp_weight": 217.2, "cvss_fn_weight": 81.9, "cvss_precision": 0.4255, "cvss_recall": 0.6625, "cvss_f3": 0.6276, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 13, "recall": 0.6579 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/ltiLaunch.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/staff-summary/route.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohort-transfers/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohort-transfers/confirm/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/reopen-request/route.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/withdraw-request/route.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/legacySync.ts", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/hardwareFeedPrivileges.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/attemptWindow.ts", "cwe": "CWE-401" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": "src/db/seed.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": "src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-916" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 27, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.55, "recall": 0.8684, "f1": 0.6735, "f2": 0.7783, "f2_score": 77.8, "f3": 0.8209, "f3_score": 82.1, "tpr": 0.8684, "fpr": 1.0, "youden_j": -0.1316, "cvss_coverage": 1.0, "cvss_tp_weight": 214.8, "cvss_fp_weight": 166.6, "cvss_fn_weight": 27.9, "cvss_precision": 0.5633, "cvss_recall": 0.885, "cvss_f3": 0.8372, "cvss_f3_score": 83.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 5, "recall": 0.8684 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": "src/actions/account.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": "src/actions/courses.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": "src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohort-transfers/confirm/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohort-transfers/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/staff-summary/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/[id]/reopen-request/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/attemptWindow.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/cohortDirectorySearch.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollmentInvite.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/guardianPortal.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCardLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staffDirectoryClient.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 33, "fp": 28, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.541, "recall": 0.8684, "f1": 0.6667, "f2": 0.7746, "f2_score": 77.5, "f3": 0.8189, "f3_score": 81.9, "tpr": 0.8684, "fpr": 1.0, "youden_j": -0.1316, "cvss_coverage": 1.0, "cvss_tp_weight": 210.3, "cvss_fp_weight": 205.5, "cvss_fn_weight": 32.4, "cvss_precision": 0.5058, "cvss_recall": 0.8665, "cvss_f3": 0.8088, "cvss_f3_score": 80.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 5, "recall": 0.8684 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": "src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": "src/actions/curve.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": "src/app/(app)/courses/[id]/certificates/CertificateWordingDesigner.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/checkpoint/status/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/sections/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/enrollment-withdrawal/route.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/[id]/media-review/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": "src/app/api/v1/courses/[id]/resources/preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": "src/app/api/v1/courses/[id]/staff-directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": "src/app/api/v1/enrollment-invites/accept/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": "src/app/api/v1/notifications/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/study-room-kiosks/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": "src/app/api/v1/submissions/[id]/grade-draft/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/certificates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": "src/lib/courseDefaults.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": "src/lib/courseMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": "src/lib/legacySync.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": "src/lib/legacySync.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": "src/lib/legacySync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": "src/lib/lessonDocumentSearch.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": "src/lib/reportCardLink.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/vendorFeedAuth.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": "src/actions/account.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": "src/actions/submissions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/apikeys.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": "src/app/api/v1/library-terminals/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": "src/actions/account.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": "src/actions/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/cohorts/[id]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/courses/[id]/assignments/[assignmentId]/rubric/duplicate/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/queries.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rosterVendorTrust.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 13, "fn": 35, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1875, "recall": 0.0789, "f1": 0.1111, "f2": 0.0893, "f2_score": 8.9, "f3": 0.0838, "f3_score": 8.4, "tpr": 0.0789, "fpr": 1.0, "youden_j": -0.9211, "cvss_coverage": 1.0, "cvss_tp_weight": 24.1, "cvss_fp_weight": 83.0, "cvss_fn_weight": 218.6, "cvss_precision": 0.225, "cvss_recall": 0.0993, "cvss_f3": 0.1052, "cvss_f3_score": 10.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 35, "recall": 0.0789 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[id]/handout-export/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/courses/[id]/syllabus-export/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/course-templates/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/rubric-templates/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/db/seed.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-029", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-030", "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkpointDraftCipher.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/courseMedia.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/gradeDraftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-613" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-fintech-lending-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 23, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4103, "recall": 0.4, "f1": 0.4051, "f2": 0.402, "f2_score": 40.2, "f3": 0.401, "f3_score": 40.1, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 114.1, "cvss_fp_weight": 128.1, "cvss_fn_weight": 139.1, "cvss_precision": 0.4711, "cvss_recall": 0.4506, "cvss_f3": 0.4526, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 24, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/outreach.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 19, "fp": 14, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5758, "recall": 0.475, "f1": 0.5205, "f2": 0.4922, "f2_score": 49.2, "f3": 0.4835, "f3_score": 48.3, "tpr": 0.475, "fpr": 1.0, "youden_j": -0.525, "cvss_coverage": 1.0, "cvss_tp_weight": 126.2, "cvss_fp_weight": 88.6, "cvss_fn_weight": 127.0, "cvss_precision": 0.5875, "cvss_recall": 0.4984, "cvss_f3": 0.5061, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 21, "recall": 0.475 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/viewState.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": null, "cwe": "CWE-611" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 22, "fp": 21, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5116, "recall": 0.55, "f1": 0.5301, "f2": 0.5419, "f2_score": 54.2, "f3": 0.5459, "f3_score": 54.6, "tpr": 0.55, "fpr": 1.0, "youden_j": -0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 144.5, "cvss_fp_weight": 121.3, "cvss_fn_weight": 108.7, "cvss_precision": 0.5437, "cvss_recall": 0.5707, "cvss_f3": 0.5679, "cvss_f3_score": 56.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 18, "recall": 0.55 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/workflow.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/viewState.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 27, "fp": 18, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.675, "f1": 0.6353, "f2": 0.6585, "f2_score": 65.9, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.675, "fpr": 1.0, "youden_j": -0.325, "cvss_coverage": 1.0, "cvss_tp_weight": 177.5, "cvss_fp_weight": 113.9, "cvss_fn_weight": 75.7, "cvss_precision": 0.609, "cvss_recall": 0.701, "cvss_f3": 0.6906, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 13, "recall": 0.675 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/shares.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": "server/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 28, "fp": 29, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4912, "recall": 0.7, "f1": 0.5773, "f2": 0.6452, "f2_score": 64.5, "f3": 0.6715, "f3_score": 67.1, "tpr": 0.7, "fpr": 1.0, "youden_j": -0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 181.9, "cvss_fp_weight": 183.6, "cvss_fn_weight": 71.3, "cvss_precision": 0.4977, "cvss_recall": 0.7184, "cvss_f3": 0.6879, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.65 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 28, "fp": 0, "fn": 12, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/shares.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/applications.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 22, "fp": 36, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3793, "recall": 0.55, "f1": 0.449, "f2": 0.5046, "f2_score": 50.5, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.55, "fpr": 1.0, "youden_j": -0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 144.6, "cvss_fp_weight": 227.9, "cvss_fn_weight": 108.6, "cvss_precision": 0.3882, "cvss_recall": 0.5711, "cvss_f3": 0.5454, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 18, "recall": 0.55 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/shares.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": "server/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 28, "fp": 31, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4746, "recall": 0.7, "f1": 0.5657, "f2": 0.6393, "f2_score": 63.9, "f3": 0.6683, "f3_score": 66.8, "tpr": 0.7, "fpr": 1.0, "youden_j": -0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 185.8, "cvss_fp_weight": 196.2, "cvss_fn_weight": 67.4, "cvss_precision": 0.4863, "cvss_recall": 0.7338, "cvss_f3": 0.6983, "cvss_f3_score": 69.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 28, "fp": 0, "fn": 12, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/servicing.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/applications.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-834" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-772" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/shares.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/context/AuthContext.tsx", "cwe": "CWE-488" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": "server/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 32, "fp": 20, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.8, "f1": 0.6957, "f2": 0.7547, "f2_score": 75.5, "f3": 0.7767, "f3_score": 77.7, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 201.7, "cvss_fp_weight": 126.6, "cvss_fn_weight": 51.5, "cvss_precision": 0.6144, "cvss_recall": 0.7966, "cvss_f3": 0.7737, "cvss_f3_score": 77.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 32, "fp": 0, "fn": 8, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": "server/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/rateLimit.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": "server/src/routes/applications.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/applications.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/servicing.ts", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 39, "fp": 48, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4483, "recall": 0.975, "f1": 0.6142, "f2": 0.7895, "f2_score": 78.9, "f3": 0.8725, "f3_score": 87.2, "tpr": 0.975, "fpr": 1.0, "youden_j": -0.025, "cvss_coverage": 1.0, "cvss_tp_weight": 246.7, "cvss_fp_weight": 378.0, "cvss_fn_weight": 6.5, "cvss_precision": 0.3949, "cvss_recall": 0.9743, "cvss_f3": 0.8497, "cvss_f3_score": 85.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 1, "recall": 0.975 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": "server/src/config.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": "server/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/applications.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": "server/src/routes/applications.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/applications.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/dataio.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/integrations.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/messages.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notes.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/outreach.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/products.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": "server/src/services/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": "server/src/services/config.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": "server/src/services/viewState.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": "server/src/services/workflow.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/shares.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/shares.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": "server/src/routes/shares.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": "server/src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": "server/src/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": "server/src/services/disbursement.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/dataio.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 8, "fp": 92, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.08, "recall": 0.2, "f1": 0.1143, "f2": 0.1538, "f2_score": 15.4, "f3": 0.1739, "f3_score": 17.4, "tpr": 0.2, "fpr": 1.0, "youden_j": -0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 58.0, "cvss_fp_weight": 529.9, "cvss_fn_weight": 195.2, "cvss_precision": 0.0987, "cvss_recall": 0.2291, "cvss_f3": 0.2023, "cvss_f3_score": 20.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 32, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/borrowers.ts", "cwe": "CWE-134" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dataio.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/documents.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/embed.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integrations.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/servicing.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vault.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-036", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-039", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-94" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-healthcare-clinic-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 20, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4118, "recall": 0.3256, "f1": 0.3636, "f2": 0.3398, "f2_score": 34.0, "f3": 0.3325, "f3_score": 33.3, "tpr": 0.3256, "fpr": 1.0, "youden_j": -0.6744, "cvss_coverage": 1.0, "cvss_tp_weight": 93.6, "cvss_fp_weight": 129.9, "cvss_fn_weight": 185.6, "cvss_precision": 0.4189, "cvss_recall": 0.3352, "cvss_f3": 0.3421, "cvss_f3_score": 34.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 28, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": "src/lib/widget-assets.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/fee-estimate.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/claims-ack-cache.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/account-confirmation.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/staff-bulk-import/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 22, "fn": 37, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.1395, "f1": 0.169, "f2": 0.15, "f2_score": 15.0, "f3": 0.1446, "f3_score": 14.5, "tpr": 0.1395, "fpr": 1.0, "youden_j": -0.8605, "cvss_coverage": 1.0, "cvss_tp_weight": 42.5, "cvss_fp_weight": 142.8, "cvss_fn_weight": 236.7, "cvss_precision": 0.2293, "cvss_recall": 0.1522, "cvss_f3": 0.1575, "cvss_f3_score": 15.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.0417 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 36, "recall": 0.1429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/handoff-confirmation/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/handoff-ack/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/reissue-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/checkin-intake/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-preferences/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/branding/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/branding/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/lab-status-widget/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/request-integrity.ts", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-73" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 21, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.3256, "f1": 0.359, "f2": 0.3382, "f2_score": 33.8, "f3": 0.3318, "f3_score": 33.2, "tpr": 0.3256, "fpr": 1.0, "youden_j": -0.6744, "cvss_coverage": 1.0, "cvss_tp_weight": 91.8, "cvss_fp_weight": 124.4, "cvss_fn_weight": 187.4, "cvss_precision": 0.4247, "cvss_recall": 0.3288, "cvss_f3": 0.3364, "cvss_f3_score": 33.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 28, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/workstation-handoff/route.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/workstation-handoff/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory-search.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-onboarding.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/claims-ack-cache.ts", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 23, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.439, "recall": 0.4186, "f1": 0.4286, "f2": 0.4225, "f2_score": 42.3, "f3": 0.4206, "f3_score": 42.1, "tpr": 0.4186, "fpr": 1.0, "youden_j": -0.5814, "cvss_coverage": 1.0, "cvss_tp_weight": 118.3, "cvss_fp_weight": 125.4, "cvss_fn_weight": 160.9, "cvss_precision": 0.4855, "cvss_recall": 0.4237, "cvss_f3": 0.4292, "cvss_f3_score": 42.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 24, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverage-access.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverage-access.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory-search.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/lab-status-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/dashboard-widgets.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/account-confirmation.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-sync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-membership.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-membership.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 40, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.322, "recall": 0.4419, "f1": 0.3725, "f2": 0.4113, "f2_score": 41.1, "f3": 0.426, "f3_score": 42.6, "tpr": 0.4419, "fpr": 1.0, "youden_j": -0.5581, "cvss_coverage": 1.0, "cvss_tp_weight": 134.0, "cvss_fp_weight": 199.8, "cvss_fn_weight": 145.2, "cvss_precision": 0.4014, "cvss_recall": 0.4799, "cvss_f3": 0.4707, "cvss_f3_score": 47.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 23, "recall": 0.4524 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory-search.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/workstation-handoff/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-roster-sync/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-roster-sync/route.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/claims-ack-cache.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/waitlist-broadcast/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/staff-bulk-import/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/booking-widget/route.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/lab-status-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handoff-copy/route.ts", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/account-confirmation.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/account-confirmation.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-redeem/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/quick-search.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/continuity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/relay.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-sync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-sync.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/request-integrity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/search-activity.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 22, "fp": 37, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3729, "recall": 0.5116, "f1": 0.4314, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4933, "f3_score": 49.3, "tpr": 0.5116, "fpr": 1.0, "youden_j": -0.4884, "cvss_coverage": 1.0, "cvss_tp_weight": 144.0, "cvss_fp_weight": 222.3, "cvss_fn_weight": 135.2, "cvss_precision": 0.3932, "cvss_recall": 0.5158, "cvss_f3": 0.5002, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 20, "recall": 0.5238 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/claims-ack-cache.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory-search.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-roster-sync/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/lib/rbac.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/schedule/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/messages/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/refills/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/documents/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/checkin-context/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/desk-note/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/supply-reservation/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/void/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/letter/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/app/api/patients/quick-search/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/roster/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/app/api/relay/prescription/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-membership.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rate-limit.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/search-activity.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/kiosk-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/workstation-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 27, "fp": 37, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4219, "recall": 0.6279, "f1": 0.5047, "f2": 0.572, "f2_score": 57.2, "f3": 0.5987, "f3_score": 59.9, "tpr": 0.6279, "fpr": 1.0, "youden_j": -0.3721, "cvss_coverage": 1.0, "cvss_tp_weight": 177.4, "cvss_fp_weight": 240.2, "cvss_fn_weight": 101.8, "cvss_precision": 0.4248, "cvss_recall": 0.6354, "cvss_f3": 0.6054, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 15, "recall": 0.6429 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": "src/lib/widget-assets.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/corp-directory-client.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/schedule/workstation-handoff/route.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/lib/rbac.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/desk-note/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/supply-reservation/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/void/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/claim-submission/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/letter/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/letter/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/documents/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/quick-search.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/continuity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/relay.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/relay/prescription/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/staff-onboarding.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/staff-bulk-import/route.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/lib/pms-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/dashboard/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-redeem/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/apikey.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/continuity/network-membership/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 29, "fp": 14, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6744, "recall": 0.6744, "f1": 0.6744, "f2": 0.6744, "f2_score": 67.4, "f3": 0.6744, "f3_score": 67.4, "tpr": 0.6744, "fpr": 1.0, "youden_j": -0.3256, "cvss_coverage": 1.0, "cvss_tp_weight": 184.4, "cvss_fp_weight": 90.9, "cvss_fn_weight": 94.8, "cvss_precision": 0.6698, "cvss_recall": 0.6605, "cvss_f3": 0.6614, "cvss_f3_score": 66.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 29, "fp": 0, "fn": 13, "recall": 0.6905 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/continuity/network-membership/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/app/api/relay/prescription/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/continuity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/coverage-access.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/lib/rbac.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/search-activity.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/relay.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/shift-handoff.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/staff-onboarding.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/quick-search.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/letter/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/letter/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/roster/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-query.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-index-search.ts", "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 39, "fp": 35, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.527, "recall": 0.907, "f1": 0.6667, "f2": 0.7927, "f2_score": 79.3, "f3": 0.846, "f3_score": 84.6, "tpr": 0.907, "fpr": 1.0, "youden_j": -0.093, "cvss_coverage": 1.0, "cvss_tp_weight": 252.1, "cvss_fp_weight": 241.5, "cvss_fn_weight": 27.1, "cvss_precision": 0.5107, "cvss_recall": 0.9029, "cvss_f3": 0.8385, "cvss_f3_score": 83.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9583 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 3, "recall": 0.9286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/admin/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/dashboard/page.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/actions.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/staff-bulk-import/route.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/api/appointments/[id]/queue-ticket/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/letter/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-lookup/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/continuity/network-membership/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/letter/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/referral-draft/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/referral-standard/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[threadId]/reply-draft/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/coverage-view/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/app/api/patients/quick-search/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/payer/claim-reconciliation/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/app/api/relay/prescription/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/roster/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/settings/intake-template/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/settings/letterhead/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/visit-summaries/[id]/printable-copy/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/availability-response.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/availability-response.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/continuity-confirmation-relay.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/continuity-return.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/fee-estimate.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/lib/ops-logger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/lib/pms-sync.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/pms-sync.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/proxy-context.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": "src/lib/referral-correspondence.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/reminder-relay.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/shift-handoff.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": "src/lib/shift-handoff.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/shift-handoff.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/shift-handoff.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/staff-onboarding.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": "src/lib/widget-assets.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/care-preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/checkin-intake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/account-confirmation.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/app/(auth)/actions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/coverage-access.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": "src/lib/network-sso-handoff.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/rbac.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": "src/lib/waitlist-broadcast.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/waitlist-digest.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/appointments/actions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/app/(app)/patients/clinical-actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/continuity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/relay.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/statement-delivery.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/network-handoff/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 16, "fn": 38, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.1163, "f1": 0.1562, "f2": 0.1295, "f2_score": 13.0, "f3": 0.1225, "f3_score": 12.3, "tpr": 0.1163, "fpr": 1.0, "youden_j": -0.8837, "cvss_coverage": 1.0, "cvss_tp_weight": 37.1, "cvss_fp_weight": 103.9, "cvss_fn_weight": 242.1, "cvss_precision": 0.2631, "cvss_recall": 0.1329, "cvss_f3": 0.1398, "cvss_f3_score": 14.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 23, "precision": 1.0, "recall": 0.0417 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 37, "recall": 0.119 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/eligibility-widget/route.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/continuity/lab-status-widget/route.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/consent-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/dashboard-widgets.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/discharge-letter.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/handoff-letter.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/handoff-letter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/intake-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/lab-requisition.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/letterhead-assets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/letterhead-assets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/policy-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/relay.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-043", "file": "src/lib/widget-assets.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-434" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-hr-payroll-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 18, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.3784, "f1": 0.4058, "f2": 0.3889, "f2_score": 38.9, "f3": 0.3836, "f3_score": 38.4, "tpr": 0.3784, "fpr": 1.0, "youden_j": -0.6216, "cvss_coverage": 1.0, "cvss_tp_weight": 98.4, "cvss_fp_weight": 105.4, "cvss_fn_weight": 130.0, "cvss_precision": 0.4827, "cvss_recall": 0.4308, "cvss_f3": 0.4355, "cvss_f3_score": 43.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 23, "recall": 0.3784 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/compPresets.server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/opsSettings.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/marketDataVendor.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/marketDataVendor.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.widget.tsx", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 12, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.52, "recall": 0.3514, "f1": 0.4194, "f2": 0.3757, "f2_score": 37.6, "f3": 0.3631, "f3_score": 36.3, "tpr": 0.3514, "fpr": 1.0, "youden_j": -0.6486, "cvss_coverage": 1.0, "cvss_tp_weight": 96.1, "cvss_fp_weight": 62.7, "cvss_fn_weight": 132.3, "cvss_precision": 0.6051, "cvss_recall": 0.4208, "cvss_f3": 0.434, "cvss_f3_score": 43.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 24, "recall": 0.3514 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 15, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4054, "f1": 0.4478, "f2": 0.4213, "f2_score": 42.1, "f3": 0.4132, "f3_score": 41.3, "tpr": 0.4054, "fpr": 1.0, "youden_j": -0.5946, "cvss_coverage": 1.0, "cvss_tp_weight": 112.1, "cvss_fp_weight": 81.2, "cvss_fn_weight": 116.3, "cvss_precision": 0.5798, "cvss_recall": 0.4908, "cvss_f3": 0.4985, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 22, "recall": 0.4054 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.tsx", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 14, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5758, "recall": 0.5135, "f1": 0.5429, "f2": 0.5249, "f2_score": 52.5, "f3": 0.5191, "f3_score": 51.9, "tpr": 0.5135, "fpr": 1.0, "youden_j": -0.4865, "cvss_coverage": 1.0, "cvss_tp_weight": 131.7, "cvss_fp_weight": 80.7, "cvss_fn_weight": 96.7, "cvss_precision": 0.6199, "cvss_recall": 0.5766, "cvss_f3": 0.5807, "cvss_f3_score": 58.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 18, "recall": 0.5135 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/audit.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/opsSettings.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.widget.tsx", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 28, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.5676, "f1": 0.4884, "f2": 0.533, "f2_score": 53.3, "f3": 0.5497, "f3_score": 55.0, "tpr": 0.5676, "fpr": 1.0, "youden_j": -0.4324, "cvss_coverage": 1.0, "cvss_tp_weight": 145.9, "cvss_fp_weight": 144.5, "cvss_fn_weight": 82.5, "cvss_precision": 0.5024, "cvss_recall": 0.6388, "cvss_f3": 0.6219, "cvss_f3_score": 62.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 16, "recall": 0.5676 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": "app/lib/branding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/opsSettings.server.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/opsSettings.server.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.widget.tsx", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.widget.tsx", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/audit.server.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/audit.server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 36, "fp": 1, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.973, "recall": 0.973, "f1": 0.973, "f2": 0.973, "f2_score": 97.3, "f3": 0.973, "f3_score": 97.3, "tpr": 0.973, "fpr": 1.0, "youden_j": -0.027, "cvss_coverage": 1.0, "cvss_tp_weight": 221.9, "cvss_fp_weight": 6.2, "cvss_fn_weight": 6.5, "cvss_precision": 0.9729, "cvss_recall": 0.9715, "cvss_f3": 0.9717, "cvss_f3_score": 97.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 36, "fp": 0, "fn": 1, "recall": 0.973 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": "app/lib/branding.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": "app/lib/marketDataVendor.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": "app/routes/app.documents.$id.cover.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": "app/routes/app.documents.$id.provenance.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": "app/routes/app.policies.ack.$id.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 25, "fp": 24, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5102, "recall": 0.6757, "f1": 0.5814, "f2": 0.6345, "f2_score": 63.5, "f3": 0.6545, "f3_score": 65.4, "tpr": 0.6757, "fpr": 1.0, "youden_j": -0.3243, "cvss_coverage": 1.0, "cvss_tp_weight": 164.9, "cvss_fp_weight": 148.2, "cvss_fn_weight": 63.5, "cvss_precision": 0.5268, "cvss_recall": 0.722, "cvss_f3": 0.6962, "cvss_f3_score": 69.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 12, "recall": 0.6757 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": "app/lib/branding.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/compPresets.server.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.$id.apply-preset.tsx", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.edit.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-407" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.$id.tsx", "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 37, "fp": 1, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.9737, "recall": 1.0, "f1": 0.9867, "f2": 0.9946, "f2_score": 99.5, "f3": 0.9973, "f3_score": 99.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 228.4, "cvss_fp_weight": 6.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.9737, "cvss_recall": 1.0, "cvss_f3": 0.9973, "cvss_f3_score": 99.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": "app/lib/branding.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": "app/lib/marketDataVendor.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": "app/routes/app.documents.$id.cover.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": "app/routes/app.documents.$id.provenance.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": "app/routes/app.policies.ack.$id.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-287" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 35, "fp": 39, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.473, "recall": 0.9459, "f1": 0.6306, "f2": 0.7883, "f2_score": 78.8, "f3": 0.86, "f3_score": 86.0, "tpr": 0.9459, "fpr": 1.0, "youden_j": -0.0541, "cvss_coverage": 1.0, "cvss_tp_weight": 219.8, "cvss_fp_weight": 276.0, "cvss_fn_weight": 8.6, "cvss_precision": 0.4433, "cvss_recall": 0.9623, "cvss_f3": 0.8615, "cvss_f3_score": 86.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 2, "recall": 0.9459 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/branding.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": "app/lib/branding.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": "app/lib/carrierAssertion.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kiosk.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": "app/lib/nav.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/opsSettings.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": "app/lib/policy-templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": "app/lib/policyBinder.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": "app/lib/printouts.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/printouts.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": "app/lib/queries.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/ticketing.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.compensation.$id.disbursement-ack.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.compensation.$id.ledger-ack.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": "app/routes/api.v1.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.requests.$id.eligibility-sync.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.v1.requests.$id.eligibility-sync.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.policies.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.vendor-receipts.convert.$preset.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": "app/routes/app.compensation.benchmark.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.compensation.record.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": "app/routes/app.documents.$id.cover.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.edit.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.onboarding-history.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.pay-history.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.employees.$id.welcome-cards.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": "app/routes/app.employees.team-summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.cover.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.policies.$id.widget.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": "app/routes/app.policies.ack.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/kiosk.punch.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": "app/lib/compPresets.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": "app/lib/ticketing.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": "app/lib/kiosk.server.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": "app/lib/serviceCertificates.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.requests._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.requests._index.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": "app/routes/kiosk.directory.tsx", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 5, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.027, "f1": 0.0465, "f2": 0.0325, "f2_score": 3.2, "f3": 0.0295, "f3_score": 2.9, "tpr": 0.027, "fpr": 1.0, "youden_j": -0.973, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 31.8, "cvss_fn_weight": 219.6, "cvss_precision": 0.2165, "cvss_recall": 0.0385, "cvss_f3": 0.042, "cvss_f3_score": 4.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 36, "recall": 0.027 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-008", "file": "app/lib/exportArchive.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/vendorPay.server.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.vendor-receipts.tsx", "cwe": "CWE-134" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-307" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-legal-case-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 8, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.2857, "f1": 0.3636, "f2": 0.3125, "f2_score": 31.2, "f3": 0.2985, "f3_score": 29.9, "tpr": 0.2857, "fpr": 1.0, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 52.1, "cvss_fp_weight": 45.1, "cvss_fn_weight": 105.8, "cvss_precision": 0.5359, "cvss_recall": 0.33, "cvss_f3": 0.3431, "cvss_f3_score": 34.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 20, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messageTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 14, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.3929, "f1": 0.4151, "f2": 0.4015, "f2_score": 40.1, "f3": 0.3971, "f3_score": 39.7, "tpr": 0.3929, "fpr": 1.0, "youden_j": -0.6071, "cvss_coverage": 1.0, "cvss_tp_weight": 65.6, "cvss_fp_weight": 79.0, "cvss_fn_weight": 92.3, "cvss_precision": 0.4538, "cvss_recall": 0.4155, "cvss_f3": 0.419, "cvss_f3_score": 41.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 17, "recall": 0.3929 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/worksheet.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/case-status.$reference.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/case-status.$reference.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/case-status.$reference.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.tsx", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 12, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4286, "f1": 0.4615, "f2": 0.4412, "f2_score": 44.1, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 76.6, "cvss_fp_weight": 52.3, "cvss_fn_weight": 81.3, "cvss_precision": 0.5945, "cvss_recall": 0.4851, "cvss_f3": 0.4942, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 16, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients._index.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/worksheet.server.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/auth.server.ts", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 18, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.5357, "f1": 0.4918, "f2": 0.5172, "f2_score": 51.7, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5357, "fpr": 1.0, "youden_j": -0.4643, "cvss_coverage": 1.0, "cvss_tp_weight": 87.7, "cvss_fp_weight": 101.5, "cvss_fn_weight": 70.2, "cvss_precision": 0.4635, "cvss_recall": 0.5554, "cvss_f3": 0.5446, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 13, "recall": 0.5357 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messageTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/billing.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.import.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/auth.server.ts", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 27, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3864, "recall": 0.6071, "f1": 0.4722, "f2": 0.5449, "f2_score": 54.5, "f3": 0.5743, "f3_score": 57.4, "tpr": 0.6071, "fpr": 1.0, "youden_j": -0.3929, "cvss_coverage": 1.0, "cvss_tp_weight": 94.6, "cvss_fp_weight": 136.8, "cvss_fn_weight": 63.3, "cvss_precision": 0.4087, "cvss_recall": 0.5991, "cvss_f3": 0.5725, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 11, "recall": 0.6071 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": "app/exhibits.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients._index.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.edit.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/auth.server.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/billing.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": "app/billing.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/phone-access.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/embedSession.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/embedSession.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/context.server.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": "app/activity.server.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 23, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4651, "recall": 0.7143, "f1": 0.5634, "f2": 0.6452, "f2_score": 64.5, "f3": 0.678, "f3_score": 67.8, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 111.2, "cvss_fp_weight": 124.6, "cvss_fn_weight": 46.7, "cvss_precision": 0.4717, "cvss_recall": 0.7042, "cvss_f3": 0.6711, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7143 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 8, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": "app/activity.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/auth.server.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": "app/billing.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/conflicts.server.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": "app/exhibits.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/exhibits.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/handoff.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": "app/notary.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": "app/retention.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients._index.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.deadlines._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 30, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.8571, "f1": 0.5854, "f2": 0.7229, "f2_score": 72.3, "f3": 0.7843, "f3_score": 78.4, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 132.6, "cvss_fp_weight": 164.0, "cvss_fn_weight": 25.3, "cvss_precision": 0.447, "cvss_recall": 0.8398, "cvss_f3": 0.7719, "cvss_f3_score": 77.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9286 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 4, "recall": 0.8571 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": "app/casedocs.server.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.deadlines._index.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.edit.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-199" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": "app/exhibits.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": "app/activity.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": "app/billing.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": "app/intakeDraft.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": "app/notary.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients._index.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": "app/retention.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": "app/routes/app.audit._index.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/exhibits.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.settings.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": "app/casedocs.server.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 27, "fp": 15, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.9643, "f1": 0.7714, "f2": 0.8766, "f2_score": 87.7, "f3": 0.9184, "f3_score": 91.8, "tpr": 0.9643, "fpr": 1.0, "youden_j": -0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 150.4, "cvss_fp_weight": 84.6, "cvss_fn_weight": 7.5, "cvss_precision": 0.64, "cvss_recall": 0.9525, "cvss_f3": 0.9082, "cvss_f3_score": 90.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 1, "recall": 0.9643 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": "app/activity.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": "app/billing.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": "app/casedocs.server.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": "app/casedocs.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": "app/exhibits.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": "app/handoff.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": "app/intakeDraft.server.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": "app/notary.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": "app/retention.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": "app/routes/app.audit._index.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.deadlines._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/subscription.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 23, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.549, "recall": 1.0, "f1": 0.7089, "f2": 0.8589, "f2_score": 85.9, "f3": 0.9241, "f3_score": 92.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 157.9, "cvss_fp_weight": 177.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.4715, "cvss_recall": 1.0, "cvss_f3": 0.8992, "cvss_f3_score": 89.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 28, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": "app/activity.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": "app/apikey.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": "app/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": "app/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": "app/billing.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": "app/casedocs.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": "app/exhibits.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/exhibits.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": "app/exhibits.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": "app/feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": "app/handoff.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": "app/intakeDraft.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messageTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": "app/notary.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": "app/render.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": "app/reportConfig.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": "app/retention.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": "app/routes/api.filing-status.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.import.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.practice-areas.guide.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.settings.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients.$clientId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.clients._index.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.messages._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.profile.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": "app/routes/app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/referral.$assertion.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": "app/viewer.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": "app/worksheet.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": "app/worksheet.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": "app/routes/app.client-contact.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/casedocs.server.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": "app/casedocs.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": "app/routes/app.audit._index.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.$token.tsx", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": "app/notary.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": "prisma/seed.ts", "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 8, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1111, "recall": 0.0357, "f1": 0.0541, "f2": 0.0413, "f2_score": 4.1, "f3": 0.0383, "f3_score": 3.8, "tpr": 0.0357, "fpr": 1.0, "youden_j": -0.9643, "cvss_coverage": 1.0, "cvss_tp_weight": 5.4, "cvss_fp_weight": 34.8, "cvss_fn_weight": 152.5, "cvss_precision": 0.1342, "cvss_recall": 0.0342, "cvss_f3": 0.037, "cvss_f3_score": 3.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 27, "recall": 0.0357 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/apikey.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/billing.server.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "app/directory.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/feed.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/intakeDraft.server.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-018", "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/richtext.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.matters.tsx", "cwe": "CWE-134" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 13, "fn": 34, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5667, "recall": 0.3333, "f1": 0.4198, "f2": 0.3632, "f2_score": 36.3, "f3": 0.3476, "f3_score": 34.8, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 110.5, "cvss_fp_weight": 80.7, "cvss_fn_weight": 206.1, "cvss_precision": 0.5779, "cvss_recall": 0.349, "cvss_f3": 0.3634, "cvss_f3_score": 36.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.2593 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 34, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/workforce.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 20, "fp": 8, "fn": 31, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.3922, "f1": 0.5063, "f2": 0.431, "f2_score": 43.1, "f3": 0.4107, "f3_score": 41.1, "tpr": 0.3922, "fpr": 1.0, "youden_j": -0.6078, "cvss_coverage": 1.0, "cvss_tp_weight": 132.6, "cvss_fp_weight": 49.7, "cvss_fn_weight": 184.0, "cvss_precision": 0.7275, "cvss_recall": 0.4188, "cvss_f3": 0.4374, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.2593 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 31, "recall": 0.3922 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 22, "fp": 10, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.4314, "f1": 0.5301, "f2": 0.4661, "f2_score": 46.6, "f3": 0.4481, "f3_score": 44.8, "tpr": 0.4314, "fpr": 1.0, "youden_j": -0.5686, "cvss_coverage": 1.0, "cvss_tp_weight": 142.8, "cvss_fp_weight": 62.1, "cvss_fn_weight": 173.8, "cvss_precision": 0.697, "cvss_recall": 0.451, "cvss_f3": 0.4675, "cvss_f3_score": 46.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2963 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 29, "recall": 0.4314 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/workforce.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 28, "fp": 20, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.549, "f1": 0.5657, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5523, "f3_score": 55.2, "tpr": 0.549, "fpr": 1.0, "youden_j": -0.451, "cvss_coverage": 1.0, "cvss_tp_weight": 175.7, "cvss_fp_weight": 112.7, "cvss_fn_weight": 140.9, "cvss_precision": 0.6091, "cvss_recall": 0.555, "cvss_f3": 0.5599, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.3704 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 28, "fp": 0, "fn": 23, "recall": 0.549 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/incidents.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/incidents.ts", "cwe": "CWE-1426" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/misc.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/misc.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/src/routes/reports.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/workforce.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 29, "fp": 29, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5686, "f1": 0.5321, "f2": 0.5534, "f2_score": 55.3, "f3": 0.5609, "f3_score": 56.1, "tpr": 0.5686, "fpr": 1.0, "youden_j": -0.4314, "cvss_coverage": 1.0, "cvss_tp_weight": 179.3, "cvss_fp_weight": 162.9, "cvss_fn_weight": 137.3, "cvss_precision": 0.524, "cvss_recall": 0.5663, "cvss_f3": 0.5618, "cvss_f3_score": 56.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.4074 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 29, "fp": 0, "fn": 22, "recall": 0.5686 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-340" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/misc.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/misc.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/misc.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/templates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-759" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/workforce.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/incidents.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 32, "fp": 31, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5079, "recall": 0.6275, "f1": 0.5614, "f2": 0.5993, "f2_score": 59.9, "f3": 0.613, "f3_score": 61.3, "tpr": 0.6275, "fpr": 1.0, "youden_j": -0.3725, "cvss_coverage": 1.0, "cvss_tp_weight": 203.1, "cvss_fp_weight": 192.4, "cvss_fn_weight": 113.5, "cvss_precision": 0.5135, "cvss_recall": 0.6415, "cvss_f3": 0.6259, "cvss_f3_score": 62.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.5185 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 32, "fp": 0, "fn": 19, "recall": 0.6275 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/kioskSession.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "server/src/routes/routes.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 35, "fp": 31, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5303, "recall": 0.6863, "f1": 0.5983, "f2": 0.6481, "f2_score": 64.8, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.6863, "fpr": 1.0, "youden_j": -0.3137, "cvss_coverage": 1.0, "cvss_tp_weight": 222.8, "cvss_fp_weight": 192.4, "cvss_fn_weight": 93.8, "cvss_precision": 0.5366, "cvss_recall": 0.7037, "cvss_f3": 0.6825, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.5185 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 16, "recall": 0.6863 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "server/src/routes/partners.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/src/routes/reports.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "server/src/routes/routes.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/integration.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": "server/src/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 26, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5593, "recall": 0.6471, "f1": 0.6, "f2": 0.6274, "f2_score": 62.7, "f3": 0.6371, "f3_score": 63.7, "tpr": 0.6471, "fpr": 1.0, "youden_j": -0.3529, "cvss_coverage": 1.0, "cvss_tp_weight": 207.3, "cvss_fp_weight": 150.0, "cvss_fn_weight": 109.3, "cvss_precision": 0.5802, "cvss_recall": 0.6548, "cvss_f3": 0.6465, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 18, "recall": 0.6471 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/src/routes/data.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "server/src/routes/partners.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "server/src/routes/routes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 47, "fp": 42, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5281, "recall": 0.9216, "f1": 0.6714, "f2": 0.802, "f2_score": 80.2, "f3": 0.8577, "f3_score": 85.8, "tpr": 0.9216, "fpr": 1.0, "youden_j": -0.0784, "cvss_coverage": 1.0, "cvss_tp_weight": 292.0, "cvss_fp_weight": 319.0, "cvss_fn_weight": 24.6, "cvss_precision": 0.4779, "cvss_recall": 0.9223, "cvss_f3": 0.8438, "cvss_f3_score": 84.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 25, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9259 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 47, "fp": 0, "fn": 4, "recall": 0.9216 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/src/lib/carrierXml.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/src/lib/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/src/lib/kioskSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestQuery.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/templates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/webhook.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/src/routes/customers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "server/src/routes/customers.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/src/routes/data.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/src/routes/data.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/incidents.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "server/src/routes/incidents.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/src/routes/jobs.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/src/routes/partners.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/proofs.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/src/routes/reports.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/src/routes/reports.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/src/routes/reports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/routes.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "server/src/routes/routes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/workforce.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "server/src/routes/workforce.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/carrierPortalSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/kioskSession.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "server/src/routes/partners.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "server/src/routes/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "server/src/routes/jobs.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/src/lib/manifestExportLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/src/routes/integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "server/src/routes/jobs.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/partners.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "server/src/routes/reports.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 18, "fn": 45, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.1176, "f1": 0.16, "f2": 0.1316, "f2_score": 13.2, "f3": 0.1242, "f3_score": 12.4, "tpr": 0.1176, "fpr": 1.0, "youden_j": -0.8824, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 111.7, "cvss_fn_weight": 278.8, "cvss_precision": 0.2528, "cvss_recall": 0.1194, "cvss_f3": 0.126, "cvss_f3_score": 12.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 25, "precision": 1.0, "recall": 0.0741 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 45, "recall": 0.1176 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/IncidentDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/views/JobDetail.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/compliance.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/lib/manifestCursor.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/customers.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/src/routes/data.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/data.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/jobs.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/legacy.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-marketplace-commerce-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 11, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.35, "f1": 0.4308, "f2": 0.3784, "f2_score": 37.8, "f3": 0.3636, "f3_score": 36.4, "tpr": 0.35, "fpr": 1.0, "youden_j": -0.65, "cvss_coverage": 1.0, "cvss_tp_weight": 94.0, "cvss_fp_weight": 61.7, "cvss_fn_weight": 150.8, "cvss_precision": 0.6037, "cvss_recall": 0.384, "cvss_f3": 0.3985, "cvss_f3_score": 39.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 26, "recall": 0.35 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/xmlConfig.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-346" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 19, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4571, "recall": 0.4, "f1": 0.4267, "f2": 0.4103, "f2_score": 41.0, "f3": 0.4051, "f3_score": 40.5, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 98.9, "cvss_fp_weight": 110.7, "cvss_fn_weight": 145.9, "cvss_precision": 0.4719, "cvss_recall": 0.404, "cvss_f3": 0.4099, "cvss_f3_score": 41.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3478 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 24, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-625" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/client/src/auth.tsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 8, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4, "f1": 0.5, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4167, "f3_score": 41.7, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 100.0, "cvss_fp_weight": 43.3, "cvss_fn_weight": 144.8, "cvss_precision": 0.6976, "cvss_recall": 0.4085, "cvss_f3": 0.4262, "cvss_f3_score": 42.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 24, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/reviews.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 14, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5882, "recall": 0.5, "f1": 0.5405, "f2": 0.5155, "f2_score": 51.5, "f3": 0.5076, "f3_score": 50.8, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 80.1, "cvss_fn_weight": 123.3, "cvss_precision": 0.6028, "cvss_recall": 0.4963, "cvss_f3": 0.5052, "cvss_f3_score": 50.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3043 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 20, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/xmlConfig.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 21, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.525, "f1": 0.5122, "f2": 0.5198, "f2_score": 52.0, "f3": 0.5224, "f3_score": 52.2, "tpr": 0.525, "fpr": 1.0, "youden_j": -0.475, "cvss_coverage": 1.0, "cvss_tp_weight": 126.9, "cvss_fp_weight": 117.3, "cvss_fn_weight": 117.9, "cvss_precision": 0.5197, "cvss_recall": 0.5184, "cvss_f3": 0.5185, "cvss_f3_score": 51.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3478 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 19, "recall": 0.525 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/xmlConfig.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 40, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 244.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": "generated-marketplace-commerce-express/server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": "generated-marketplace-commerce-express/server/src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-312" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 22, "fp": 27, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.449, "recall": 0.55, "f1": 0.4944, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5379, "f3_score": 53.8, "tpr": 0.55, "fpr": 1.0, "youden_j": -0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 133.8, "cvss_fp_weight": 165.2, "cvss_fn_weight": 111.0, "cvss_precision": 0.4474, "cvss_recall": 0.5466, "cvss_f3": 0.5347, "cvss_f3_score": 53.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.5217 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 18, "recall": 0.55 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/client/src/pages/public/ProductDetail.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/shipmentEvents.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-837" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-1284" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 40, "fp": 8, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 1.0, "f1": 0.9091, "f2": 0.9615, "f2_score": 96.2, "f3": 0.9804, "f3_score": 98.0, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 244.8, "cvss_fp_weight": 43.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.8496, "cvss_recall": 1.0, "cvss_f3": 0.9826, "cvss_f3_score": 98.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": "generated-marketplace-commerce-express/server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": "generated-marketplace-commerce-express/server/src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 39, "fp": 43, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4756, "recall": 0.975, "f1": 0.6393, "f2": 0.8058, "f2_score": 80.6, "f3": 0.8824, "f3_score": 88.2, "tpr": 0.975, "fpr": 1.0, "youden_j": -0.025, "cvss_coverage": 1.0, "cvss_tp_weight": 237.3, "cvss_fp_weight": 309.0, "cvss_fn_weight": 7.5, "cvss_precision": 0.4344, "cvss_recall": 0.9694, "cvss_f3": 0.8631, "cvss_f3_score": 86.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 1, "recall": 0.975 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/client/src/pages/public/ProductDetail.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": "generated-marketplace-commerce-express/server/src/lib/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/callSession.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": "generated-marketplace-commerce-express/server/src/lib/env.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": "generated-marketplace-commerce-express/server/src/lib/preferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/callSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/callSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": "generated-marketplace-commerce-express/server/src/lib/outbox.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 55, "fn": 33, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1129, "recall": 0.175, "f1": 0.1373, "f2": 0.1577, "f2_score": 15.8, "f3": 0.1659, "f3_score": 16.6, "tpr": 0.175, "fpr": 1.0, "youden_j": -0.825, "cvss_coverage": 1.0, "cvss_tp_weight": 45.2, "cvss_fp_weight": 306.3, "cvss_fn_weight": 199.6, "cvss_precision": 0.1286, "cvss_recall": 0.1846, "cvss_f3": 0.1769, "cvss_f3_score": 17.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0435 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 33, "recall": 0.175 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/promotions.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/secureStorage.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/lib/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-010", "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/data.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/misc.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-015", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-017", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-021", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-022", "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/payouts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-026", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-032", "file": "generated-marketplace-commerce-express/server/src/routes/products.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/users.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-marketplace-commerce-express/server/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-030", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-033", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-036", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-property-management-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 19, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4571, "recall": 0.5, "f1": 0.4776, "f2": 0.4908, "f2_score": 49.1, "f3": 0.4954, "f3_score": 49.5, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 98.4, "cvss_fp_weight": 118.1, "cvss_fn_weight": 100.5, "cvss_precision": 0.4545, "cvss_recall": 0.4947, "cvss_f3": 0.4904, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 16, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": "server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/notify.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-611" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 12, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.4688, "f1": 0.5085, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4688, "fpr": 1.0, "youden_j": -0.5312, "cvss_coverage": 1.0, "cvss_tp_weight": 101.7, "cvss_fp_weight": 63.2, "cvss_fn_weight": 97.2, "cvss_precision": 0.6169, "cvss_recall": 0.5113, "cvss_f3": 0.5202, "cvss_f3_score": 52.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 17, "recall": 0.4688 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/notify.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-916" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 18, "fp": 21, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.5625, "f1": 0.507, "f2": 0.5389, "f2_score": 53.9, "f3": 0.5505, "f3_score": 55.0, "tpr": 0.5625, "fpr": 1.0, "youden_j": -0.4375, "cvss_coverage": 1.0, "cvss_tp_weight": 112.1, "cvss_fp_weight": 107.7, "cvss_fn_weight": 86.8, "cvss_precision": 0.5101, "cvss_recall": 0.5636, "cvss_f3": 0.5577, "cvss_f3_score": 55.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 14, "recall": 0.5625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/costAllocation.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-697" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 35, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4068, "recall": 0.75, "f1": 0.5275, "f2": 0.6417, "f2_score": 64.2, "f3": 0.6916, "f3_score": 69.2, "tpr": 0.75, "fpr": 1.0, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 149.7, "cvss_fp_weight": 211.8, "cvss_fn_weight": 49.2, "cvss_precision": 0.4141, "cvss_recall": 0.7526, "cvss_f3": 0.6958, "cvss_f3_score": 69.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 8, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-843" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": "server/src/services/noticeTemplates.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": "server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/notify.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 22, "fp": 39, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3607, "recall": 0.6875, "f1": 0.4731, "f2": 0.582, "f2_score": 58.2, "f3": 0.6304, "f3_score": 63.0, "tpr": 0.6875, "fpr": 1.0, "youden_j": -0.3125, "cvss_coverage": 1.0, "cvss_tp_weight": 137.8, "cvss_fp_weight": 236.7, "cvss_fn_weight": 61.1, "cvss_precision": 0.368, "cvss_recall": 0.6928, "cvss_f3": 0.6366, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 10, "recall": 0.6875 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/costAllocation.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/notify.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/noticeTemplates.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": "server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 31, "fp": 19, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.62, "recall": 0.9688, "f1": 0.7561, "f2": 0.8708, "f2_score": 87.1, "f3": 0.9172, "f3_score": 91.7, "tpr": 0.9688, "fpr": 1.0, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 190.1, "cvss_fp_weight": 112.4, "cvss_fn_weight": 8.8, "cvss_precision": 0.6285, "cvss_recall": 0.9558, "cvss_f3": 0.9084, "cvss_f3_score": 90.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 1, "recall": 0.9688 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": "server/src/entities/enums.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": "server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": "server/src/routes/leases.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": "server/src/routes/payments.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": "server/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": "server/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": "server/src/services/noticeTemplates.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 23, "fp": 35, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3966, "recall": 0.7188, "f1": 0.5111, "f2": 0.6183, "f2_score": 61.8, "f3": 0.6647, "f3_score": 66.5, "tpr": 0.7188, "fpr": 1.0, "youden_j": -0.2812, "cvss_coverage": 1.0, "cvss_tp_weight": 147.0, "cvss_fp_weight": 200.4, "cvss_fn_weight": 51.9, "cvss_precision": 0.4231, "cvss_recall": 0.7391, "cvss_f3": 0.6877, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 9, "recall": 0.7188 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": "server/src/routes/payments.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-834" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/attemptThrottle.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/lobbyKiosk.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": "server/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": "server/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 38, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3667, "recall": 0.6875, "f1": 0.4783, "f2": 0.5851, "f2_score": 58.5, "f3": 0.6322, "f3_score": 63.2, "tpr": 0.6875, "fpr": 1.0, "youden_j": -0.3125, "cvss_coverage": 1.0, "cvss_tp_weight": 140.0, "cvss_fp_weight": 230.5, "cvss_fn_weight": 58.9, "cvss_precision": 0.3779, "cvss_recall": 0.7039, "cvss_f3": 0.648, "cvss_f3_score": 64.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 10, "recall": 0.6875 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/access.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/noticeTemplates.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/vendorAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/attemptThrottle.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/lobbyKiosk.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/documents.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": "server/src/routes/payments.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 31, "fp": 32, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4921, "recall": 0.9688, "f1": 0.6526, "f2": 0.8115, "f2_score": 81.2, "f3": 0.8832, "f3_score": 88.3, "tpr": 0.9688, "fpr": 1.0, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 190.8, "cvss_fp_weight": 241.0, "cvss_fn_weight": 8.1, "cvss_precision": 0.4419, "cvss_recall": 0.9593, "cvss_f3": 0.8587, "cvss_f3_score": 85.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 1, "recall": 0.9688 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": "server/src/routes/kiosk.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": "server/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": "server/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": "server/src/routes/payments.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": "server/src/routes/reports.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": "server/src/routes/reports.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": "server/src/routes/reports.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/tickets.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": "server/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": "server/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/seed/seed.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": "server/src/services/costAllocation.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/costAllocation.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/lobbyKiosk.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": "server/src/services/noticeTemplates.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": "server/src/services/notify.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/segments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": "server/src/utils/crypto.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": "server/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": "server/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": "server/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": "server/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/leases.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": "server/src/routes/leases.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/reports.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/access.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": "server/src/entities/enums.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/payments.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": "server/src/seed/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": "server/src/services/billing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/kiosk.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 22, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1852, "recall": 0.1562, "f1": 0.1695, "f2": 0.1613, "f2_score": 16.1, "f3": 0.1587, "f3_score": 15.9, "tpr": 0.1562, "fpr": 1.0, "youden_j": -0.8438, "cvss_coverage": 1.0, "cvss_tp_weight": 33.6, "cvss_fp_weight": 136.7, "cvss_fn_weight": 165.3, "cvss_precision": 0.1972, "cvss_recall": 0.1689, "cvss_f3": 0.1714, "cvss_f3_score": 17.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 27, "recall": 0.1562 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/notifications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-012", "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/publicApi.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-013", "file": "server/src/routes/reports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-024", "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-025", "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/noticeLetters.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-028", "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/screeningVendor.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/shipmentXmlCatalog.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/crypto.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/marketFeed.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-611" } ] }, "sonarqube": null }, "vc-claude-code-seeded-v3-support-desk-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 23, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.425, "recall": 0.4146, "f1": 0.4198, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4156, "f3_score": 41.6, "tpr": 0.4146, "fpr": 1.0, "youden_j": -0.5854, "cvss_coverage": 1.0, "cvss_tp_weight": 112.0, "cvss_fp_weight": 144.8, "cvss_fn_weight": 156.9, "cvss_precision": 0.4362, "cvss_recall": 0.4165, "cvss_f3": 0.4184, "cvss_f3_score": 41.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.28 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 23, "recall": 0.425 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 11, "fn": 31, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4762, "recall": 0.2439, "f1": 0.3226, "f2": 0.2703, "f2_score": 27.0, "f3": 0.2564, "f3_score": 25.6, "tpr": 0.2439, "fpr": 1.0, "youden_j": -0.7561, "cvss_coverage": 1.0, "cvss_tp_weight": 68.5, "cvss_fp_weight": 60.0, "cvss_fn_weight": 200.4, "cvss_precision": 0.533, "cvss_recall": 0.2547, "cvss_f3": 0.2688, "cvss_f3_score": 26.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.12 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 30, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": null, "cwe": "CWE-532" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 16, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4839, "recall": 0.3659, "f1": 0.4167, "f2": 0.3846, "f2_score": 38.5, "f3": 0.375, "f3_score": 37.5, "tpr": 0.3659, "fpr": 1.0, "youden_j": -0.6341, "cvss_coverage": 1.0, "cvss_tp_weight": 92.2, "cvss_fp_weight": 92.8, "cvss_fn_weight": 176.7, "cvss_precision": 0.4983, "cvss_recall": 0.3429, "cvss_f3": 0.3539, "cvss_f3_score": 35.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.24 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 25, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": null, "cwe": "CWE-916" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 28, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4043, "recall": 0.4634, "f1": 0.4318, "f2": 0.4502, "f2_score": 45.0, "f3": 0.4567, "f3_score": 45.7, "tpr": 0.4634, "fpr": 1.0, "youden_j": -0.5366, "cvss_coverage": 1.0, "cvss_tp_weight": 122.1, "cvss_fp_weight": 177.6, "cvss_fn_weight": 146.8, "cvss_precision": 0.4074, "cvss_recall": 0.4541, "cvss_f3": 0.4489, "cvss_f3_score": 44.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 21, "recall": 0.475 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 26, "fp": 39, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.6341, "f1": 0.4906, "f2": 0.5677, "f2_score": 56.8, "f3": 0.5991, "f3_score": 59.9, "tpr": 0.6341, "fpr": 1.0, "youden_j": -0.3659, "cvss_coverage": 1.0, "cvss_tp_weight": 162.5, "cvss_fp_weight": 231.5, "cvss_fn_weight": 106.4, "cvss_precision": 0.4124, "cvss_recall": 0.6043, "cvss_f3": 0.5774, "cvss_f3_score": 57.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 14, "recall": 0.65 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 41, "fp": 14, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7455, "recall": 1.0, "f1": 0.8542, "f2": 0.9361, "f2_score": 93.6, "f3": 0.967, "f3_score": 96.7, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 268.9, "cvss_fp_weight": 91.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.7455, "cvss_recall": 1.0, "cvss_f3": 0.967, "cvss_f3_score": 96.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 25, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 29, "fp": 35, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4531, "recall": 0.7073, "f1": 0.5524, "f2": 0.636, "f2_score": 63.6, "f3": 0.6697, "f3_score": 67.0, "tpr": 0.7073, "fpr": 1.0, "youden_j": -0.2927, "cvss_coverage": 1.0, "cvss_tp_weight": 185.8, "cvss_fp_weight": 217.4, "cvss_fn_weight": 83.1, "cvss_precision": 0.4608, "cvss_recall": 0.691, "cvss_f3": 0.6581, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.68 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 29, "fp": 0, "fn": 11, "recall": 0.725 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-185" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-340" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-340" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 41, "fp": 28, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5942, "recall": 1.0, "f1": 0.7455, "f2": 0.8798, "f2_score": 88.0, "f3": 0.9361, "f3_score": 93.6, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 268.9, "cvss_fp_weight": 177.6, "cvss_fn_weight": 0.0, "cvss_precision": 0.6023, "cvss_recall": 1.0, "cvss_f3": 0.9381, "cvss_f3_score": 93.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 25, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory-client.ts", "cwe": "CWE-319" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 38, "fp": 29, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5672, "recall": 0.9268, "f1": 0.7037, "f2": 0.8225, "f2_score": 82.3, "f3": 0.8716, "f3_score": 87.2, "tpr": 0.9268, "fpr": 1.0, "youden_j": -0.0732, "cvss_coverage": 1.0, "cvss_tp_weight": 249.9, "cvss_fp_weight": 223.5, "cvss_fn_weight": 19.0, "cvss_precision": 0.5279, "cvss_recall": 0.9293, "cvss_f3": 0.8637, "cvss_f3_score": 86.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 24, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.96 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 38, "fp": 0, "fn": 2, "recall": 0.95 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/kb/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/ops/ops.controller.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/tickets/shipment-tracking.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": "backend/src/users/users.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": "backend/src/webhooks/api-key.guard.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/kb/kb.controller.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 22, "fn": 38, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.12, "recall": 0.0732, "f1": 0.0909, "f2": 0.0794, "f2_score": 7.9, "f3": 0.0761, "f3_score": 7.6, "tpr": 0.0732, "fpr": 1.0, "youden_j": -0.9268, "cvss_coverage": 1.0, "cvss_tp_weight": 25.7, "cvss_fp_weight": 144.3, "cvss_fn_weight": 243.2, "cvss_precision": 0.1512, "cvss_recall": 0.0956, "cvss_f3": 0.0992, "cvss_f3_score": 9.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 24, "precision": 1.0, "recall": 0.04 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 37, "recall": 0.075 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/at-rest-cipher.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config-admin/config-admin.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/kiosk-access/kiosk-access.controller.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.controller.ts", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-732" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-036", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-037", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-038", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-claude-code-seeded-v3-support-desk-nestjs-angular-041", "file": null, "cwe": "CWE-532" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v2-crm-saas-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 13, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5938, "recall": 0.76, "f1": 0.6667, "f2": 0.7197, "f2_score": 72.0, "f3": 0.7393, "f3_score": 73.9, "tpr": 0.76, "fpr": 0.7647, "youden_j": -0.0047, "cvss_coverage": 1.0, "cvss_tp_weight": 101.4, "cvss_fp_weight": 55.0, "cvss_fn_weight": 30.4, "cvss_precision": 0.6482, "cvss_recall": 0.7693, "cvss_f3": 0.7552, "cvss_f3_score": 75.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-061", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-340", "file": "config/partner_console.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": ".env.example", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 8, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.68, "recall": 0.68, "f1": 0.68, "f2": 0.68, "f2_score": 68.0, "f3": 0.68, "f3_score": 68.0, "tpr": 0.68, "fpr": 0.6667, "youden_j": 0.0133, "cvss_coverage": 1.0, "cvss_tp_weight": 90.9, "cvss_fp_weight": 24.2, "cvss_fn_weight": 40.9, "cvss_precision": 0.7896, "cvss_recall": 0.6897, "cvss_f3": 0.6985, "cvss_f3_score": 69.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 3, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.56, "f1": 0.6667, "f2": 0.5983, "f2_score": 59.8, "f3": 0.5785, "f3_score": 57.9, "tpr": 0.56, "fpr": 0.4286, "youden_j": 0.1314, "cvss_coverage": 1.0, "cvss_tp_weight": 72.5, "cvss_fp_weight": 9.6, "cvss_fn_weight": 59.3, "cvss_precision": 0.8832, "cvss_recall": 0.5501, "cvss_f3": 0.5716, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 5, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.52, "f1": 0.6047, "f2": 0.5508, "f2_score": 55.1, "f3": 0.535, "f3_score": 53.5, "tpr": 0.52, "fpr": 0.625, "youden_j": -0.105, "cvss_coverage": 1.0, "cvss_tp_weight": 71.0, "cvss_fp_weight": 22.7, "cvss_fn_weight": 60.8, "cvss_precision": 0.7575, "cvss_recall": 0.5387, "cvss_f3": 0.5547, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 5, "fp": 1, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.6, "f1": 0.6383, "f2": 0.6148, "f2_score": 61.5, "f3": 0.6073, "f3_score": 60.7, "tpr": 0.6, "fpr": 0.6364, "youden_j": -0.0364, "cvss_coverage": 1.0, "cvss_tp_weight": 79.1, "cvss_fp_weight": 27.8, "cvss_fn_weight": 52.7, "cvss_precision": 0.7402, "cvss_recall": 0.6002, "cvss_f3": 0.6117, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-061", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9546, "recall": 0.4, "f1": 0.5635, "f2": 0.4525, "f2_score": 45.2, "f3": 0.4246, "f3_score": 42.5, "tpr": 0.4, "fpr": 0.1, "youden_j": 0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 54.0, "cvss_fp_weight": 2.2, "cvss_fn_weight": 77.8, "cvss_precision": 0.9612, "cvss_recall": 0.4097, "cvss_f3": 0.4346, "cvss_f3_score": 43.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 131.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-062", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-063", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-161", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-585", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-633", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 2, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8775, "recall": 0.5733, "f1": 0.6934, "f2": 0.6159, "f2_score": 61.6, "f3": 0.5939, "f3_score": 59.4, "tpr": 0.5733, "fpr": 0.3333, "youden_j": 0.24, "cvss_coverage": 1.0, "cvss_tp_weight": 75.2, "cvss_fp_weight": 6.4, "cvss_fn_weight": 56.6, "cvss_precision": 0.9214, "cvss_recall": 0.5703, "cvss_f3": 0.5928, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 6, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7322, "recall": 0.6533, "f1": 0.6902, "f2": 0.6676, "f2_score": 66.8, "f3": 0.6603, "f3_score": 66.0, "tpr": 0.6533, "fpr": 0.5926, "youden_j": 0.0607, "cvss_coverage": 1.0, "cvss_tp_weight": 88.5, "cvss_fp_weight": 23.2, "cvss_fn_weight": 43.3, "cvss_precision": 0.7916, "cvss_recall": 0.6712, "cvss_f3": 0.6814, "cvss_f3_score": 68.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-061", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 14, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7558, "recall": 0.5733, "f1": 0.6517, "f2": 0.6023, "f2_score": 60.2, "f3": 0.5874, "f3_score": 58.7, "tpr": 0.5733, "fpr": 0.5333, "youden_j": 0.04, "cvss_coverage": 1.0, "cvss_tp_weight": 75.9, "cvss_fp_weight": 18.5, "cvss_fn_weight": 55.9, "cvss_precision": 0.8052, "cvss_recall": 0.5761, "cvss_f3": 0.5929, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 4, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8261, "recall": 0.76, "f1": 0.7917, "f2": 0.7724, "f2_score": 77.2, "f3": 0.7661, "f3_score": 76.6, "tpr": 0.76, "fpr": 0.5, "youden_j": 0.26, "cvss_coverage": 1.0, "cvss_tp_weight": 99.9, "cvss_fp_weight": 14.1, "cvss_fn_weight": 31.9, "cvss_precision": 0.8761, "cvss_recall": 0.758, "cvss_f3": 0.7683, "cvss_f3_score": 76.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-340", "file": "config/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 11, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6802, "recall": 0.4533, "f1": 0.5439, "f2": 0.4857, "f2_score": 48.6, "f3": 0.4689, "f3_score": 46.9, "tpr": 0.4533, "fpr": 0.5704, "youden_j": -0.1171, "cvss_coverage": 1.0, "cvss_tp_weight": 63.4, "cvss_fp_weight": 16.1, "cvss_fn_weight": 68.4, "cvss_precision": 0.7971, "cvss_recall": 0.4808, "cvss_f3": 0.5006, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 3, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8125, "recall": 0.52, "f1": 0.6341, "f2": 0.5603, "f2_score": 56.0, "f3": 0.5394, "f3_score": 53.9, "tpr": 0.52, "fpr": 0.4286, "youden_j": 0.0914, "cvss_coverage": 1.0, "cvss_tp_weight": 68.8, "cvss_fp_weight": 9.6, "cvss_fn_weight": 63.0, "cvss_precision": 0.8777, "cvss_recall": 0.522, "cvss_f3": 0.544, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 131.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-061", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-340", "file": "config/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": "crm/views.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.48, "f1": 0.5714, "f2": 0.5128, "f2_score": 51.3, "f3": 0.4959, "f3_score": 49.6, "tpr": 0.48, "fpr": 0.5556, "youden_j": -0.0756, "cvss_coverage": 1.0, "cvss_tp_weight": 63.6, "cvss_fp_weight": 22.7, "cvss_fn_weight": 68.2, "cvss_precision": 0.7368, "cvss_recall": 0.4825, "cvss_f3": 0.4998, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 10, "fp": 9, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5263, "recall": 0.4, "f1": 0.4545, "f2": 0.4202, "f2_score": 42.0, "f3": 0.4098, "f3_score": 41.0, "tpr": 0.4, "fpr": 0.6923, "youden_j": -0.2923, "cvss_coverage": 1.0, "cvss_tp_weight": 56.2, "cvss_fp_weight": 36.9, "cvss_fn_weight": 75.6, "cvss_precision": 0.6039, "cvss_recall": 0.4264, "cvss_f3": 0.4393, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 17, "fp": 11, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.68, "f1": 0.6415, "f2": 0.6641, "f2_score": 66.4, "f3": 0.6719, "f3_score": 67.2, "tpr": 0.68, "fpr": 0.7333, "youden_j": -0.0533, "cvss_coverage": 1.0, "cvss_tp_weight": 89.4, "cvss_fp_weight": 45.9, "cvss_fn_weight": 42.4, "cvss_precision": 0.6605, "cvss_recall": 0.6783, "cvss_f3": 0.6765, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-061", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 4, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7444, "recall": 0.4933, "f1": 0.5907, "f2": 0.5278, "f2_score": 52.8, "f3": 0.5099, "f3_score": 51.0, "tpr": 0.4933, "fpr": 0.5095, "youden_j": -0.0162, "cvss_coverage": 1.0, "cvss_tp_weight": 65.3, "cvss_fp_weight": 11.6, "cvss_fn_weight": 66.5, "cvss_precision": 0.8515, "cvss_recall": 0.4957, "cvss_f3": 0.5169, "cvss_f3_score": 51.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 11, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.73, "recall": 0.4267, "f1": 0.5376, "f2": 0.465, "f2_score": 46.5, "f3": 0.445, "f3_score": 44.5, "tpr": 0.4267, "fpr": 0.4947, "youden_j": -0.0681, "cvss_coverage": 1.0, "cvss_tp_weight": 60.9, "cvss_fp_weight": 11.4, "cvss_fn_weight": 70.9, "cvss_precision": 0.8427, "cvss_recall": 0.4621, "cvss_f3": 0.4838, "cvss_f3_score": 48.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6108, "recall": 0.48, "f1": 0.537, "f2": 0.5012, "f2_score": 50.1, "f3": 0.4904, "f3_score": 49.1, "tpr": 0.48, "fpr": 0.655, "youden_j": -0.175, "cvss_coverage": 1.0, "cvss_tp_weight": 66.8, "cvss_fp_weight": 18.7, "cvss_fn_weight": 65.0, "cvss_precision": 0.7838, "cvss_recall": 0.5068, "cvss_f3": 0.5254, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/crm/form_page.html", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.68, "f1": 0.7083, "f2": 0.6911, "f2_score": 69.1, "f3": 0.6855, "f3_score": 68.5, "tpr": 0.68, "fpr": 0.6, "youden_j": 0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 90.9, "cvss_fp_weight": 23.2, "cvss_fn_weight": 40.9, "cvss_precision": 0.7965, "cvss_recall": 0.6897, "cvss_f3": 0.6991, "cvss_f3_score": 69.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 19, "fp": 16, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5429, "recall": 0.76, "f1": 0.6333, "f2": 0.7037, "f2_score": 70.4, "f3": 0.7308, "f3_score": 73.1, "tpr": 0.76, "fpr": 0.8421, "youden_j": -0.0821, "cvss_coverage": 1.0, "cvss_tp_weight": 100.5, "cvss_fp_weight": 86.0, "cvss_fn_weight": 31.3, "cvss_precision": 0.5389, "cvss_recall": 0.7625, "cvss_f3": 0.7321, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 8, "fp": 1, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 18, "fp": 52, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2571, "recall": 0.72, "f1": 0.3789, "f2": 0.5294, "f2_score": 52.9, "f3": 0.6102, "f3_score": 61.0, "tpr": 0.72, "fpr": 0.9286, "youden_j": -0.2086, "cvss_coverage": 1.0, "cvss_tp_weight": 95.5, "cvss_fp_weight": 326.5, "cvss_fn_weight": 36.3, "cvss_precision": 0.2263, "cvss_recall": 0.7246, "cvss_f3": 0.5938, "cvss_f3_score": 59.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/crm/form_page.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/crm/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-642" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": "crm/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-311" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 21, "fp": 40, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3443, "recall": 0.84, "f1": 0.4884, "f2": 0.6522, "f2_score": 65.2, "f3": 0.7343, "f3_score": 73.4, "tpr": 0.84, "fpr": 0.9091, "youden_j": -0.0691, "cvss_coverage": 1.0, "cvss_tp_weight": 108.5, "cvss_fp_weight": 281.0, "cvss_fn_weight": 23.3, "cvss_precision": 0.2786, "cvss_recall": 0.8232, "cvss_f3": 0.6886, "cvss_f3_score": 68.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-258" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": "crm/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/authz.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 3, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.12, "f1": 0.1935, "f2": 0.1415, "f2_score": 14.2, "f3": 0.1299, "f3_score": 13.0, "tpr": 0.12, "fpr": 0.4286, "youden_j": -0.3086, "cvss_coverage": 1.0, "cvss_tp_weight": 16.4, "cvss_fp_weight": 18.0, "cvss_fn_weight": 115.4, "cvss_precision": 0.4767, "cvss_recall": 0.1244, "cvss_f3": 0.1344, "cvss_f3_score": 13.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "medium": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/urls.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-063", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-585", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-633", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 61, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2561, "recall": 0.84, "f1": 0.3925, "f2": 0.5769, "f2_score": 57.7, "f3": 0.684, "f3_score": 68.4, "tpr": 0.84, "fpr": 0.9531, "youden_j": -0.1131, "cvss_coverage": 1.0, "cvss_tp_weight": 109.6, "cvss_fp_weight": 425.5, "cvss_fn_weight": 22.2, "cvss_precision": 0.2048, "cvss_recall": 0.8316, "cvss_f3": 0.6367, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 1, "fn": 2, "precision": 0.9333, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 9, "fp": 1, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": "crm/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/crm/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_reset_email.html", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 23, "fp": 14, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6216, "recall": 0.92, "f1": 0.7419, "f2": 0.8394, "f2_score": 83.9, "f3": 0.8779, "f3_score": 87.8, "tpr": 0.92, "fpr": 0.8235, "youden_j": 0.0965, "cvss_coverage": 1.0, "cvss_tp_weight": 121.1, "cvss_fp_weight": 102.0, "cvss_fn_weight": 10.7, "cvss_precision": 0.5428, "cvss_recall": 0.9188, "cvss_f3": 0.8593, "cvss_f3_score": 85.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 11, "fp": 1, "fn": 1, "recall": 0.9167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-340", "file": "config/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 11, "fp": 8, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.44, "f1": 0.5, "f2": 0.4622, "f2_score": 46.2, "f3": 0.4508, "f3_score": 45.1, "tpr": 0.44, "fpr": 0.6667, "youden_j": -0.2267, "cvss_coverage": 1.0, "cvss_tp_weight": 62.1, "cvss_fp_weight": 49.5, "cvss_fn_weight": 69.7, "cvss_precision": 0.5565, "cvss_recall": 0.4712, "cvss_f3": 0.4785, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 87, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2018, "recall": 0.88, "f1": 0.3284, "f2": 0.5263, "f2_score": 52.6, "f3": 0.6587, "f3_score": 65.9, "tpr": 0.88, "fpr": 0.9667, "youden_j": -0.0867, "cvss_coverage": 1.0, "cvss_tp_weight": 114.9, "cvss_fp_weight": 576.0, "cvss_fn_weight": 16.9, "cvss_precision": 0.1663, "cvss_recall": 0.8718, "cvss_f3": 0.6121, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 1, "fn": 1, "precision": 0.9375, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 10, "fp": 1, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-133", "file": "config/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-202", "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-340", "file": "config/partner_console.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-553", "file": "config/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-623", "file": "config/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": "crm/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": "crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/crm/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/password_reset_email.html", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 12, "fp": 2, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8928, "recall": 0.48, "f1": 0.6241, "f2": 0.5289, "f2_score": 52.9, "f3": 0.5032, "f3_score": 50.3, "tpr": 0.48, "fpr": 0.2143, "youden_j": 0.2657, "cvss_coverage": 1.0, "cvss_tp_weight": 67.3, "cvss_fp_weight": 6.8, "cvss_fn_weight": 64.5, "cvss_precision": 0.9118, "cvss_recall": 0.5106, "cvss_f3": 0.534, "cvss_f3_score": 53.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/forms.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 131.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-062", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-063", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-161", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-585", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-633", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 14, "fp": 7, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.56, "f1": 0.6087, "f2": 0.5785, "f2_score": 57.9, "f3": 0.5691, "f3_score": 56.9, "tpr": 0.56, "fpr": 0.6364, "youden_j": -0.0764, "cvss_coverage": 1.0, "cvss_tp_weight": 74.7, "cvss_fp_weight": 31.8, "cvss_fn_weight": 57.1, "cvss_precision": 0.7013, "cvss_recall": 0.5668, "cvss_f3": 0.5779, "cvss_f3_score": 57.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-161", "file": "config/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-062", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-244", "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-592", "file": "config/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-563", "file": "config/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-573", "file": "config/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-613", "file": "config/partner_console.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-610" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 17, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2273, "recall": 0.2, "f1": 0.2128, "f2": 0.2049, "f2_score": 20.5, "f3": 0.2024, "f3_score": 20.2, "tpr": 0.2, "fpr": 0.8095, "youden_j": -0.6095, "cvss_coverage": 1.0, "cvss_tp_weight": 27.3, "cvss_fp_weight": 63.0, "cvss_fn_weight": 104.5, "cvss_precision": 0.3023, "cvss_recall": 0.2071, "cvss_f3": 0.2139, "cvss_f3_score": 21.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-585", "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/tests.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-062", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-161", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 11, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7333, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 50.0, "cvss_fn_weight": 131.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/config/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/crm/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-crm-saas-django/templates/registration/login.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-062", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-063", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-161", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-282", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-585", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-603", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-633", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-643", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 37, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.119, "recall": 0.2, "f1": 0.1493, "f2": 0.1761, "f2_score": 17.6, "f3": 0.1873, "f3_score": 18.7, "tpr": 0.2, "fpr": 0.9024, "youden_j": -0.7024, "cvss_coverage": 1.0, "cvss_tp_weight": 22.9, "cvss_fp_weight": 178.1, "cvss_fn_weight": 108.9, "cvss_precision": 0.1139, "cvss_recall": 0.1737, "cvss_f3": 0.1651, "cvss_f3_score": 16.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-063", "file": "config/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-282", "file": "config/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-603", "file": "config/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-633", "file": "config/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-643", "file": "config/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/partner_console.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-061", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-062", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-133", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-161", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-202", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-244", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-340", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-553", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-563", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-573", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-585", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-592", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-613", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-623", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-916" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-high-seeded-v2-education-lms-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 9, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6786, "recall": 0.76, "f1": 0.717, "f2": 0.7422, "f2_score": 74.2, "f3": 0.751, "f3_score": 75.1, "tpr": 0.76, "fpr": 0.6923, "youden_j": 0.0677, "cvss_coverage": 1.0, "cvss_tp_weight": 110.1, "cvss_fp_weight": 45.1, "cvss_fn_weight": 35.3, "cvss_precision": 0.7093, "cvss_recall": 0.7572, "cvss_f3": 0.7521, "cvss_f3_score": 75.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-341", "file": "education_lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.6, "f1": 0.6667, "f2": 0.625, "f2_score": 62.5, "f3": 0.6122, "f3_score": 61.2, "tpr": 0.6, "fpr": 0.5556, "youden_j": 0.0444, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 16.0, "cvss_fn_weight": 58.8, "cvss_precision": 0.8437, "cvss_recall": 0.5956, "cvss_f3": 0.6136, "cvss_f3_score": 61.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.44, "f1": 0.5366, "f2": 0.4741, "f2_score": 47.4, "f3": 0.4564, "f3_score": 45.6, "tpr": 0.44, "fpr": 0.5556, "youden_j": -0.1156, "cvss_coverage": 1.0, "cvss_tp_weight": 68.1, "cvss_fp_weight": 16.0, "cvss_fn_weight": 77.3, "cvss_precision": 0.8094, "cvss_recall": 0.4684, "cvss_f3": 0.489, "cvss_f3_score": 48.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 11, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5926, "recall": 0.64, "f1": 0.6154, "f2": 0.6299, "f2_score": 63.0, "f3": 0.6349, "f3_score": 63.5, "tpr": 0.64, "fpr": 0.7333, "youden_j": -0.0933, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 46.1, "cvss_fn_weight": 53.9, "cvss_precision": 0.6649, "cvss_recall": 0.6293, "cvss_f3": 0.6327, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 7, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.64, "f1": 0.6667, "f2": 0.6504, "f2_score": 65.0, "f3": 0.6452, "f3_score": 64.5, "tpr": 0.64, "fpr": 0.6364, "youden_j": 0.0036, "cvss_coverage": 1.0, "cvss_tp_weight": 87.3, "cvss_fp_weight": 35.1, "cvss_fn_weight": 58.1, "cvss_precision": 0.7133, "cvss_recall": 0.6004, "cvss_f3": 0.6101, "cvss_f3_score": 61.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 7, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8328, "recall": 0.2933, "f1": 0.4308, "f2": 0.3361, "f2_score": 33.6, "f3": 0.3132, "f3_score": 31.3, "tpr": 0.2933, "fpr": 0.2444, "youden_j": 0.0489, "cvss_coverage": 1.0, "cvss_tp_weight": 43.9, "cvss_fp_weight": 6.7, "cvss_fn_weight": 101.5, "cvss_precision": 0.8578, "cvss_recall": 0.3019, "cvss_f3": 0.3226, "cvss_f3_score": 32.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.28, "f1": 0.4242, "f2": 0.3241, "f2_score": 32.4, "f3": 0.3004, "f3_score": 30.0, "tpr": 0.28, "fpr": 0.2, "youden_j": 0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 43.8, "cvss_fp_weight": 5.0, "cvss_fn_weight": 101.6, "cvss_precision": 0.8973, "cvss_recall": 0.3012, "cvss_f3": 0.3227, "cvss_f3_score": 32.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7456, "recall": 0.5467, "f1": 0.6301, "f2": 0.5771, "f2_score": 57.7, "f3": 0.5615, "f3_score": 56.1, "tpr": 0.5467, "fpr": 0.5371, "youden_j": 0.0096, "cvss_coverage": 1.0, "cvss_tp_weight": 77.3, "cvss_fp_weight": 12.9, "cvss_fn_weight": 68.1, "cvss_precision": 0.8631, "cvss_recall": 0.5319, "cvss_f3": 0.5523, "cvss_f3_score": 55.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 6, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7289, "recall": 0.64, "f1": 0.6814, "f2": 0.6559, "f2_score": 65.6, "f3": 0.6478, "f3_score": 64.8, "tpr": 0.64, "fpr": 0.5926, "youden_j": 0.0474, "cvss_coverage": 1.0, "cvss_tp_weight": 90.8, "cvss_fp_weight": 21.0, "cvss_fn_weight": 54.6, "cvss_precision": 0.8128, "cvss_recall": 0.6243, "cvss_f3": 0.639, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 11, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6374, "recall": 0.68, "f1": 0.6506, "f2": 0.6657, "f2_score": 66.6, "f3": 0.6724, "f3_score": 67.2, "tpr": 0.68, "fpr": 0.6852, "youden_j": -0.0052, "cvss_coverage": 1.0, "cvss_tp_weight": 96.9, "cvss_fp_weight": 40.1, "cvss_fn_weight": 48.5, "cvss_precision": 0.7316, "cvss_recall": 0.6664, "cvss_f3": 0.6705, "cvss_f3_score": 67.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 19, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4865, "recall": 0.72, "f1": 0.5806, "f2": 0.6569, "f2_score": 65.7, "f3": 0.687, "f3_score": 68.7, "tpr": 0.72, "fpr": 0.8261, "youden_j": -0.1061, "cvss_coverage": 1.0, "cvss_tp_weight": 101.8, "cvss_fp_weight": 86.2, "cvss_fn_weight": 43.6, "cvss_precision": 0.5414, "cvss_recall": 0.7001, "cvss_f3": 0.6802, "cvss_f3_score": 68.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6142, "recall": 0.5467, "f1": 0.5755, "f2": 0.5572, "f2_score": 55.7, "f3": 0.5518, "f3_score": 55.2, "tpr": 0.5467, "fpr": 0.6788, "youden_j": -0.1321, "cvss_coverage": 1.0, "cvss_tp_weight": 83.0, "cvss_fp_weight": 26.9, "cvss_fn_weight": 62.4, "cvss_precision": 0.7567, "cvss_recall": 0.5709, "cvss_f3": 0.5848, "cvss_f3_score": 58.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.48, "f1": 0.6, "f2": 0.5217, "f2_score": 52.2, "f3": 0.5, "f3_score": 50.0, "tpr": 0.48, "fpr": 0.4286, "youden_j": 0.0514, "cvss_coverage": 1.0, "cvss_tp_weight": 67.4, "cvss_fp_weight": 6.0, "cvss_fn_weight": 78.0, "cvss_precision": 0.9181, "cvss_recall": 0.4635, "cvss_f3": 0.4877, "cvss_f3_score": 48.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 16, "fp": 7, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.64, "f1": 0.6667, "f2": 0.6504, "f2_score": 65.0, "f3": 0.6452, "f3_score": 64.5, "tpr": 0.64, "fpr": 0.6364, "youden_j": 0.0036, "cvss_coverage": 1.0, "cvss_tp_weight": 85.8, "cvss_fp_weight": 30.6, "cvss_fn_weight": 59.6, "cvss_precision": 0.7372, "cvss_recall": 0.5901, "cvss_f3": 0.6021, "cvss_f3_score": 60.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 3, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.56, "f1": 0.6667, "f2": 0.5983, "f2_score": 59.8, "f3": 0.5785, "f3_score": 57.9, "tpr": 0.56, "fpr": 0.4286, "youden_j": 0.1314, "cvss_coverage": 1.0, "cvss_tp_weight": 86.3, "cvss_fp_weight": 6.0, "cvss_fn_weight": 59.1, "cvss_precision": 0.9349, "cvss_recall": 0.5935, "cvss_f3": 0.616, "cvss_f3_score": 61.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 12, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.48, "f1": 0.4898, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4819, "f3_score": 48.2, "tpr": 0.48, "fpr": 0.75, "youden_j": -0.27, "cvss_coverage": 1.0, "cvss_tp_weight": 80.5, "cvss_fp_weight": 46.6, "cvss_fn_weight": 64.9, "cvss_precision": 0.6332, "cvss_recall": 0.5536, "cvss_f3": 0.5607, "cvss_f3_score": 56.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/permissions.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/lms/submission_detail.html", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 10, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 0.76, "f1": 0.7037, "f2": 0.7364, "f2_score": 73.6, "f3": 0.748, "f3_score": 74.8, "tpr": 0.76, "fpr": 0.7143, "youden_j": 0.0457, "cvss_coverage": 1.0, "cvss_tp_weight": 105.7, "cvss_fp_weight": 27.6, "cvss_fn_weight": 39.7, "cvss_precision": 0.7931, "cvss_recall": 0.727, "cvss_f3": 0.7331, "cvss_f3_score": 73.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-554", "file": "education_lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-367" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7216, "recall": 0.52, "f1": 0.6042, "f2": 0.5506, "f2_score": 55.1, "f3": 0.5349, "f3_score": 53.5, "tpr": 0.52, "fpr": 0.5556, "youden_j": -0.0356, "cvss_coverage": 1.0, "cvss_tp_weight": 73.2, "cvss_fp_weight": 22.1, "cvss_fn_weight": 72.2, "cvss_precision": 0.7685, "cvss_recall": 0.5032, "cvss_f3": 0.5211, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-554", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6681, "recall": 0.48, "f1": 0.5575, "f2": 0.5081, "f2_score": 50.8, "f3": 0.4936, "f3_score": 49.4, "tpr": 0.48, "fpr": 0.5973, "youden_j": -0.1173, "cvss_coverage": 1.0, "cvss_tp_weight": 68.3, "cvss_fp_weight": 13.5, "cvss_fn_weight": 77.1, "cvss_precision": 0.8332, "cvss_recall": 0.4698, "cvss_f3": 0.491, "cvss_f3_score": 49.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 8, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6234, "recall": 0.5467, "f1": 0.5823, "f2": 0.5604, "f2_score": 56.1, "f3": 0.5534, "f3_score": 55.3, "tpr": 0.5467, "fpr": 0.6687, "youden_j": -0.122, "cvss_coverage": 1.0, "cvss_tp_weight": 82.0, "cvss_fp_weight": 22.2, "cvss_fn_weight": 63.4, "cvss_precision": 0.787, "cvss_recall": 0.5637, "cvss_f3": 0.5801, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 19, "fp": 10, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 0.76, "f1": 0.7037, "f2": 0.7364, "f2_score": 73.6, "f3": 0.748, "f3_score": 74.8, "tpr": 0.76, "fpr": 0.7143, "youden_j": 0.0457, "cvss_coverage": 1.0, "cvss_tp_weight": 108.8, "cvss_fp_weight": 27.6, "cvss_fn_weight": 36.6, "cvss_precision": 0.7978, "cvss_recall": 0.7483, "cvss_f3": 0.753, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 5, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.64, "f1": 0.6957, "f2": 0.6612, "f2_score": 66.1, "f3": 0.6504, "f3_score": 65.0, "tpr": 0.64, "fpr": 0.625, "youden_j": 0.015, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 38.0, "cvss_fn_weight": 46.0, "cvss_precision": 0.7234, "cvss_recall": 0.6836, "cvss_f3": 0.6874, "cvss_f3_score": 68.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 9, "fp": 1, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-162", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 18, "fp": 46, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2812, "recall": 0.72, "f1": 0.4045, "f2": 0.5488, "f2_score": 54.9, "f3": 0.6228, "f3_score": 62.3, "tpr": 0.72, "fpr": 0.92, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 102.7, "cvss_fp_weight": 310.5, "cvss_fn_weight": 42.7, "cvss_precision": 0.2485, "cvss_recall": 0.7063, "cvss_f3": 0.5965, "cvss_f3_score": 59.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/login.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/signals.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 17, "fp": 34, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.68, "f1": 0.4474, "f2": 0.5629, "f2_score": 56.3, "f3": 0.6159, "f3_score": 61.6, "tpr": 0.68, "fpr": 0.8947, "youden_j": -0.2147, "cvss_coverage": 1.0, "cvss_tp_weight": 94.2, "cvss_fp_weight": 213.0, "cvss_fn_weight": 51.2, "cvss_precision": 0.3066, "cvss_recall": 0.6479, "cvss_f3": 0.583, "cvss_f3_score": 58.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-603" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/login.html", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 1, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.08, "f1": 0.1429, "f2": 0.0971, "f2_score": 9.7, "f3": 0.0877, "f3_score": 8.8, "tpr": 0.08, "fpr": 0.2, "youden_j": -0.12, "cvss_coverage": 1.0, "cvss_tp_weight": 7.8, "cvss_fp_weight": 8.0, "cvss_fn_weight": 137.6, "cvss_precision": 0.4937, "cvss_recall": 0.0536, "cvss_f3": 0.0589, "cvss_f3_score": 5.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-064", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-586", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-616", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-634", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 22, "fp": 40, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3548, "recall": 0.88, "f1": 0.5057, "f2": 0.679, "f2_score": 67.9, "f3": 0.7666, "f3_score": 76.7, "tpr": 0.88, "fpr": 0.9091, "youden_j": -0.0291, "cvss_coverage": 1.0, "cvss_tp_weight": 127.1, "cvss_fp_weight": 270.5, "cvss_fn_weight": 18.3, "cvss_precision": 0.3197, "cvss_recall": 0.8741, "cvss_f3": 0.7449, "cvss_f3_score": 74.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 13, "fp": 0, "fn": 2, "recall": 0.8667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-554", "file": "education_lms/course_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/login.html", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 13, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6486, "recall": 0.96, "f1": 0.7742, "f2": 0.8759, "f2_score": 87.6, "f3": 0.916, "f3_score": 91.6, "tpr": 0.96, "fpr": 0.7647, "youden_j": 0.1953, "cvss_coverage": 1.0, "cvss_tp_weight": 141.0, "cvss_fp_weight": 91.5, "cvss_fn_weight": 4.4, "cvss_precision": 0.6065, "cvss_recall": 0.9697, "cvss_f3": 0.9149, "cvss_f3_score": 91.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 1, "recall": 0.9333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-341", "file": "education_lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-554", "file": "education_lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": "education_lms/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": "education_lms/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 13, "fp": 13, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.52, "f1": 0.5098, "f2": 0.5159, "f2_score": 51.6, "f3": 0.5179, "f3_score": 51.8, "tpr": 0.52, "fpr": 0.7647, "youden_j": -0.2447, "cvss_coverage": 1.0, "cvss_tp_weight": 87.9, "cvss_fp_weight": 94.0, "cvss_fn_weight": 57.5, "cvss_precision": 0.4832, "cvss_recall": 0.6045, "cvss_f3": 0.5897, "cvss_f3_score": 59.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": "education_lms/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 67, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2472, "recall": 0.88, "f1": 0.386, "f2": 0.582, "f2_score": 58.2, "f3": 0.7006, "f3_score": 70.1, "tpr": 0.88, "fpr": 0.9437, "youden_j": -0.0637, "cvss_coverage": 1.0, "cvss_tp_weight": 127.1, "cvss_fp_weight": 427.5, "cvss_fn_weight": 18.3, "cvss_precision": 0.2292, "cvss_recall": 0.8741, "cvss_f3": 0.6822, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 13, "fp": 0, "fn": 2, "recall": 0.8667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-065", "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-134", "file": "education_lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-066", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-245", "file": "education_lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-554", "file": "education_lms/course_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-624", "file": "education_lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": "education_lms/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/permissions.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/registration/login.html", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 8, "fp": 7, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.32, "f1": 0.4, "f2": 0.3478, "f2_score": 34.8, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.32, "fpr": 0.6364, "youden_j": -0.3164, "cvss_coverage": 1.0, "cvss_tp_weight": 47.0, "cvss_fp_weight": 26.1, "cvss_fn_weight": 98.4, "cvss_precision": 0.6432, "cvss_recall": 0.3232, "cvss_f3": 0.3402, "cvss_f3_score": 34.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-064", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 145.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-064", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-162", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-586", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-616", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-634", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 11, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4762, "recall": 0.4, "f1": 0.4348, "f2": 0.4132, "f2_score": 41.3, "f3": 0.4065, "f3_score": 40.7, "tpr": 0.4, "fpr": 0.7333, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 58.2, "cvss_fp_weight": 37.1, "cvss_fn_weight": 87.2, "cvss_precision": 0.6107, "cvss_recall": 0.4003, "cvss_f3": 0.4146, "cvss_f3_score": 41.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lm/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-593", "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-162", "file": "education_lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-564", "file": "education_lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-574", "file": "education_lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-222", "file": "education_lms/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-17" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-616", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 34, "fn": 20, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1282, "recall": 0.2, "f1": 0.1562, "f2": 0.1799, "f2_score": 18.0, "f3": 0.1894, "f3_score": 18.9, "tpr": 0.2, "fpr": 0.9189, "youden_j": -0.7189, "cvss_coverage": 1.0, "cvss_tp_weight": 32.1, "cvss_fp_weight": 112.5, "cvss_fn_weight": 113.3, "cvss_precision": 0.222, "cvss_recall": 0.2208, "cvss_f3": 0.2209, "cvss_f3_score": 22.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 1, "fn": 7, "recall": 0.125 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-616", "file": "education_lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": "lms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-586", "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-064", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-162", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 12, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.75, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 60.2, "cvss_fn_weight": 145.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/education_lms/course_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/lms/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/lms/services.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-education-lms-django/lms/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-064", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-162", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-283", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-586", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-604", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-616", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-634", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-644", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 38, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1163, "recall": 0.2, "f1": 0.1471, "f2": 0.1748, "f2_score": 17.5, "f3": 0.1866, "f3_score": 18.7, "tpr": 0.2, "fpr": 0.9048, "youden_j": -0.7048, "cvss_coverage": 1.0, "cvss_tp_weight": 25.8, "cvss_fp_weight": 199.5, "cvss_fn_weight": 119.6, "cvss_precision": 0.1145, "cvss_recall": 0.1774, "cvss_f3": 0.1682, "cvss_f3_score": 16.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-064", "file": "education_lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-283", "file": "education_lms/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-604", "file": "education_lms/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-634", "file": "education_lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-644", "file": "education_lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/course_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "education_lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-065", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-066", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-134", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-162", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-222", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-245", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-341", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-554", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-564", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-574", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-586", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-593", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-616", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-624", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-high-seeded-v2-fintech-lending-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 7, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.7241, "f1": 0.7368, "f2": 0.7292, "f2_score": 72.9, "f3": 0.7266, "f3_score": 72.7, "tpr": 0.7241, "fpr": 0.6364, "youden_j": 0.0878, "cvss_coverage": 1.0, "cvss_tp_weight": 119.3, "cvss_fp_weight": 25.6, "cvss_fn_weight": 39.3, "cvss_precision": 0.8234, "cvss_recall": 0.7522, "cvss_f3": 0.7588, "cvss_f3_score": 75.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 3, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.5862, "f1": 0.6939, "f2": 0.625, "f2_score": 62.5, "f3": 0.605, "f3_score": 60.5, "tpr": 0.5862, "fpr": 0.4286, "youden_j": 0.1576, "cvss_coverage": 1.0, "cvss_tp_weight": 93.7, "cvss_fp_weight": 10.3, "cvss_fn_weight": 64.9, "cvss_precision": 0.9006, "cvss_recall": 0.5908, "cvss_f3": 0.6118, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-261", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5862, "f1": 0.7083, "f2": 0.6296, "f2_score": 63.0, "f3": 0.6071, "f3_score": 60.7, "tpr": 0.5862, "fpr": 0.3333, "youden_j": 0.2529, "cvss_coverage": 1.0, "cvss_tp_weight": 95.9, "cvss_fp_weight": 5.4, "cvss_fn_weight": 62.7, "cvss_precision": 0.9465, "cvss_recall": 0.6047, "cvss_f3": 0.6273, "cvss_f3_score": 62.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.4828, "f1": 0.6087, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5036, "f3_score": 50.4, "tpr": 0.4828, "fpr": 0.4286, "youden_j": 0.0542, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 14.8, "cvss_fn_weight": 76.0, "cvss_precision": 0.8484, "cvss_recall": 0.5208, "cvss_f3": 0.5417, "cvss_f3_score": 54.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.5517, "f1": 0.6667, "f2": 0.5926, "f2_score": 59.3, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5517, "fpr": 0.4286, "youden_j": 0.1232, "cvss_coverage": 1.0, "cvss_tp_weight": 86.8, "cvss_fp_weight": 14.8, "cvss_fn_weight": 71.8, "cvss_precision": 0.8547, "cvss_recall": 0.5473, "cvss_f3": 0.5677, "cvss_f3_score": 56.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 12, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3966, "f1": 0.5677, "f2": 0.4509, "f2_score": 45.1, "f3": 0.422, "f3_score": 42.2, "tpr": 0.3966, "fpr": 0.0, "youden_j": 0.3966, "cvss_coverage": 1.0, "cvss_tp_weight": 68.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 90.2, "cvss_precision": 1.0, "cvss_recall": 0.4316, "cvss_f3": 0.4576, "cvss_f3_score": 45.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 9, "fp": 0, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3103, "f1": 0.4737, "f2": 0.36, "f2_score": 36.0, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.3103, "fpr": 0.0, "youden_j": 0.3103, "cvss_coverage": 1.0, "cvss_tp_weight": 58.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 100.5, "cvss_precision": 1.0, "cvss_recall": 0.3663, "cvss_f3": 0.3911, "cvss_f3_score": 39.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8306, "recall": 0.4483, "f1": 0.5822, "f2": 0.4937, "f2_score": 49.3, "f3": 0.4699, "f3_score": 47.0, "tpr": 0.4483, "fpr": 0.3968, "youden_j": 0.0514, "cvss_coverage": 1.0, "cvss_tp_weight": 76.6, "cvss_fp_weight": 13.1, "cvss_fn_weight": 82.0, "cvss_precision": 0.854, "cvss_recall": 0.4828, "cvss_f3": 0.5047, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 19, "fp": 4, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8289, "recall": 0.6552, "f1": 0.731, "f2": 0.6834, "f2_score": 68.3, "f3": 0.6689, "f3_score": 66.9, "tpr": 0.6552, "fpr": 0.4857, "youden_j": 0.1695, "cvss_coverage": 1.0, "cvss_tp_weight": 112.1, "cvss_fp_weight": 7.9, "cvss_fn_weight": 46.5, "cvss_precision": 0.9347, "cvss_recall": 0.7068, "cvss_f3": 0.7243, "cvss_f3_score": 72.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 13, "fp": 8, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4171, "recall": 0.4598, "f1": 0.4373, "f2": 0.4505, "f2_score": 45.0, "f3": 0.4551, "f3_score": 45.5, "tpr": 0.4598, "fpr": 0.4993, "youden_j": -0.0396, "cvss_coverage": 1.0, "cvss_tp_weight": 76.8, "cvss_fp_weight": 24.6, "cvss_fn_weight": 81.8, "cvss_precision": 0.5049, "cvss_recall": 0.4844, "cvss_f3": 0.4864, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-87" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 25, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4318, "recall": 0.6552, "f1": 0.5205, "f2": 0.5938, "f2_score": 59.4, "f3": 0.623, "f3_score": 62.3, "tpr": 0.6552, "fpr": 0.8621, "youden_j": -0.2069, "cvss_coverage": 1.0, "cvss_tp_weight": 102.6, "cvss_fp_weight": 118.5, "cvss_fn_weight": 56.0, "cvss_precision": 0.464, "cvss_recall": 0.6469, "cvss_f3": 0.6224, "cvss_f3_score": 62.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7248, "recall": 0.5632, "f1": 0.6316, "f2": 0.5884, "f2_score": 58.9, "f3": 0.5754, "f3_score": 57.5, "tpr": 0.5632, "fpr": 0.5974, "youden_j": -0.0342, "cvss_coverage": 1.0, "cvss_tp_weight": 97.7, "cvss_fp_weight": 16.4, "cvss_fn_weight": 60.9, "cvss_precision": 0.8568, "cvss_recall": 0.6158, "cvss_f3": 0.6333, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 9, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.4138, "f1": 0.48, "f2": 0.438, "f2_score": 43.8, "f3": 0.4255, "f3_score": 42.6, "tpr": 0.4138, "fpr": 0.6923, "youden_j": -0.2785, "cvss_coverage": 1.0, "cvss_tp_weight": 77.2, "cvss_fp_weight": 35.4, "cvss_fn_weight": 81.4, "cvss_precision": 0.6854, "cvss_recall": 0.4868, "cvss_f3": 0.5013, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 2, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9355, "recall": 1.0, "f1": 0.9667, "f2": 0.9864, "f2_score": 98.6, "f3": 0.9932, "f3_score": 99.3, "tpr": 1.0, "fpr": 0.3333, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 9.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.9416, "cvss_recall": 1.0, "cvss_f3": 0.9938, "cvss_f3_score": 99.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 10, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.5172, "f1": 0.5556, "f2": 0.5319, "f2_score": 53.2, "f3": 0.5245, "f3_score": 52.4, "tpr": 0.5172, "fpr": 0.7143, "youden_j": -0.197, "cvss_coverage": 1.0, "cvss_tp_weight": 94.7, "cvss_fp_weight": 44.8, "cvss_fn_weight": 63.9, "cvss_precision": 0.679, "cvss_recall": 0.5971, "cvss_f3": 0.6044, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 7, "fp": 12, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.2414, "f1": 0.2917, "f2": 0.2593, "f2_score": 25.9, "f3": 0.25, "f3_score": 25.0, "tpr": 0.2414, "fpr": 0.75, "youden_j": -0.5086, "cvss_coverage": 1.0, "cvss_tp_weight": 44.9, "cvss_fp_weight": 54.6, "cvss_fn_weight": 113.7, "cvss_precision": 0.4513, "cvss_recall": 0.2831, "cvss_f3": 0.2941, "cvss_f3_score": 29.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 15, "recall": 0.0625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-069", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-261", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-635", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 29, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8682, "recall": 0.4713, "f1": 0.6081, "f2": 0.5176, "f2_score": 51.8, "f3": 0.4933, "f3_score": 49.3, "tpr": 0.4713, "fpr": 0.2963, "youden_j": 0.175, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 5.6, "cvss_fn_weight": 79.0, "cvss_precision": 0.9358, "cvss_recall": 0.5019, "cvss_f3": 0.5262, "cvss_f3_score": 52.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8248, "recall": 0.5172, "f1": 0.6344, "f2": 0.5583, "f2_score": 55.8, "f3": 0.537, "f3_score": 53.7, "tpr": 0.5172, "fpr": 0.4185, "youden_j": 0.0987, "cvss_coverage": 1.0, "cvss_tp_weight": 86.7, "cvss_fp_weight": 3.1, "cvss_fn_weight": 71.9, "cvss_precision": 0.9649, "cvss_recall": 0.5464, "cvss_f3": 0.5712, "cvss_f3_score": 57.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7162, "recall": 0.5747, "f1": 0.6368, "f2": 0.5979, "f2_score": 59.8, "f3": 0.5861, "f3_score": 58.6, "tpr": 0.5747, "fpr": 0.6196, "youden_j": -0.0448, "cvss_coverage": 1.0, "cvss_tp_weight": 97.4, "cvss_fp_weight": 12.2, "cvss_fn_weight": 61.2, "cvss_precision": 0.8906, "cvss_recall": 0.6143, "cvss_f3": 0.6338, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 19, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5128, "recall": 0.6897, "f1": 0.5882, "f2": 0.6452, "f2_score": 64.5, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.6897, "fpr": 0.8261, "youden_j": -0.1364, "cvss_coverage": 1.0, "cvss_tp_weight": 112.9, "cvss_fp_weight": 75.8, "cvss_fn_weight": 45.7, "cvss_precision": 0.5984, "cvss_recall": 0.7119, "cvss_f3": 0.6986, "cvss_f3_score": 69.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-302" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5517, "f1": 0.6038, "f2": 0.5714, "f2_score": 57.1, "f3": 0.5614, "f3_score": 56.1, "tpr": 0.5517, "fpr": 0.6667, "youden_j": -0.1149, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 36.0, "cvss_fn_weight": 59.6, "cvss_precision": 0.7333, "cvss_recall": 0.6242, "cvss_f3": 0.6336, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 23, "fp": 39, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.371, "recall": 0.7931, "f1": 0.5055, "f2": 0.6461, "f2_score": 64.6, "f3": 0.7121, "f3_score": 71.2, "tpr": 0.7931, "fpr": 0.907, "youden_j": -0.1139, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 268.0, "cvss_fn_weight": 28.3, "cvss_precision": 0.3271, "cvss_recall": 0.8216, "cvss_f3": 0.7137, "cvss_f3_score": 71.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 22, "fp": 29, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4314, "recall": 0.7586, "f1": 0.55, "f2": 0.6587, "f2_score": 65.9, "f3": 0.7051, "f3_score": 70.5, "tpr": 0.7586, "fpr": 0.8788, "youden_j": -0.1202, "cvss_coverage": 1.0, "cvss_tp_weight": 126.3, "cvss_fp_weight": 213.0, "cvss_fn_weight": 32.3, "cvss_precision": 0.3722, "cvss_recall": 0.7963, "cvss_f3": 0.7149, "cvss_f3_score": 71.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0345, "f1": 0.0667, "f2": 0.0427, "f2_score": 4.3, "f3": 0.0382, "f3_score": 3.8, "tpr": 0.0345, "fpr": 0.0, "youden_j": 0.0345, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 149.5, "cvss_precision": 1.0, "cvss_recall": 0.0574, "cvss_f3": 0.0633, "cvss_f3_score": 6.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-069", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-178", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-261", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-594", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-614", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-635", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 20, "fp": 36, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3571, "recall": 0.6897, "f1": 0.4706, "f2": 0.5814, "f2_score": 58.1, "f3": 0.6309, "f3_score": 63.1, "tpr": 0.6897, "fpr": 0.9, "youden_j": -0.2103, "cvss_coverage": 1.0, "cvss_tp_weight": 112.9, "cvss_fp_weight": 273.0, "cvss_fn_weight": 45.7, "cvss_precision": 0.2926, "cvss_recall": 0.7119, "cvss_f3": 0.6226, "cvss_f3_score": 62.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 29, "fp": 10, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7436, "recall": 1.0, "f1": 0.8529, "f2": 0.9355, "f2_score": 93.5, "f3": 0.9667, "f3_score": 96.7, "tpr": 1.0, "fpr": 0.7143, "youden_j": 0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 77.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.6717, "cvss_recall": 1.0, "cvss_f3": 0.9534, "cvss_f3_score": 95.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-135", "file": "app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 33, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 0.7241, "f1": 0.506, "f2": 0.6176, "f2_score": 61.8, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.7241, "fpr": 0.8919, "youden_j": -0.1678, "cvss_coverage": 1.0, "cvss_tp_weight": 118.5, "cvss_fp_weight": 220.0, "cvss_fn_weight": 40.1, "cvss_precision": 0.3501, "cvss_recall": 0.7472, "cvss_f3": 0.671, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 20, "fp": 48, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2941, "recall": 0.6897, "f1": 0.4124, "f2": 0.5435, "f2_score": 54.3, "f3": 0.6079, "f3_score": 60.8, "tpr": 0.6897, "fpr": 0.9231, "youden_j": -0.2334, "cvss_coverage": 1.0, "cvss_tp_weight": 112.9, "cvss_fp_weight": 348.0, "cvss_fn_weight": 45.7, "cvss_precision": 0.245, "cvss_recall": 0.7119, "cvss_f3": 0.5979, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-068", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-203", "file": "app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-555", "file": "app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-625", "file": "app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5834, "recall": 0.3448, "f1": 0.4293, "f2": 0.3739, "f2_score": 37.4, "f3": 0.3587, "f3_score": 35.9, "tpr": 0.3448, "fpr": 0.635, "youden_j": -0.2901, "cvss_coverage": 1.0, "cvss_tp_weight": 61.6, "cvss_fp_weight": 34.7, "cvss_fn_weight": 97.0, "cvss_precision": 0.6478, "cvss_recall": 0.3887, "cvss_f3": 0.4044, "cvss_f3_score": 40.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-067", "file": "app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 158.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-069", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-178", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-261", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-594", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-614", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-635", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 15, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4643, "recall": 0.4483, "f1": 0.4561, "f2": 0.4514, "f2_score": 45.1, "f3": 0.4498, "f3_score": 45.0, "tpr": 0.4483, "fpr": 0.7895, "youden_j": -0.3412, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 56.1, "cvss_fn_weight": 76.0, "cvss_precision": 0.5955, "cvss_recall": 0.5208, "cvss_f3": 0.5274, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-565", "file": "app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-213" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-594", "file": "app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-575", "file": "app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "rowan": { "scanner": "rowan", "tp": 12, "fp": 40, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2308, "recall": 0.4138, "f1": 0.2963, "f2": 0.3571, "f2_score": 35.7, "f3": 0.3834, "f3_score": 38.3, "tpr": 0.4138, "fpr": 0.9091, "youden_j": -0.4953, "cvss_coverage": 1.0, "cvss_tp_weight": 71.9, "cvss_fp_weight": 206.5, "cvss_fn_weight": 86.7, "cvss_precision": 0.2583, "cvss_recall": 0.4533, "cvss_f3": 0.4215, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-583", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-326", "file": "app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-614", "file": "app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/create_db.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/smoke_check.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_authorization_workflows.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-069", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-594", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 10, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7143, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 49.2, "cvss_fn_weight": 158.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/scripts/create_db.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-fintech-lending-fastapi/scripts/create_db.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-069", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-178", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-261", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-296", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-594", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-605", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-614", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-635", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-645", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 8, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.2414, "f1": 0.3182, "f2": 0.2672, "f2_score": 26.7, "f3": 0.2536, "f3_score": 25.4, "tpr": 0.2414, "fpr": 0.6667, "youden_j": -0.4253, "cvss_coverage": 1.0, "cvss_tp_weight": 40.5, "cvss_fp_weight": 48.5, "cvss_fn_weight": 118.1, "cvss_precision": 0.455, "cvss_recall": 0.2554, "cvss_f3": 0.2671, "cvss_f3_score": 26.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-069", "file": "app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-178", "file": "app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-261", "file": "app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-296", "file": "app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-605", "file": "app/loan_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-635", "file": "app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-645", "file": "app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "app/loan_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-067", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-068", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-135", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-203", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-326", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-555", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-565", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-575", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-583", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-594", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-614", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-625", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] } }, "vc-codex-high-seeded-v2-healthcare-clinic-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 7, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.8077, "f1": 0.7778, "f2": 0.7955, "f2_score": 79.5, "f3": 0.8015, "f3_score": 80.2, "tpr": 0.8077, "fpr": 0.6364, "youden_j": 0.1713, "cvss_coverage": 1.0, "cvss_tp_weight": 119.6, "cvss_fp_weight": 29.9, "cvss_fn_weight": 27.5, "cvss_precision": 0.7999, "cvss_recall": 0.8131, "cvss_f3": 0.8117, "cvss_f3_score": 81.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-342", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-636", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 9, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.5769, "f1": 0.6, "f2": 0.5859, "f2_score": 58.6, "f3": 0.5814, "f3_score": 58.1, "tpr": 0.5769, "fpr": 0.75, "youden_j": -0.1731, "cvss_coverage": 1.0, "cvss_tp_weight": 89.2, "cvss_fp_weight": 39.7, "cvss_fn_weight": 57.9, "cvss_precision": 0.6919, "cvss_recall": 0.6064, "cvss_f3": 0.614, "cvss_f3_score": 61.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 7, "fp": 1, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-342", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.4615, "f1": 0.5581, "f2": 0.4959, "f2_score": 49.6, "f3": 0.4781, "f3_score": 47.8, "tpr": 0.4615, "fpr": 0.5556, "youden_j": -0.094, "cvss_coverage": 1.0, "cvss_tp_weight": 73.9, "cvss_fp_weight": 20.1, "cvss_fn_weight": 73.2, "cvss_precision": 0.7861, "cvss_recall": 0.5024, "cvss_f3": 0.5212, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 5, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.4231, "f1": 0.5238, "f2": 0.4583, "f2_score": 45.8, "f3": 0.44, "f3_score": 44.0, "tpr": 0.4231, "fpr": 0.5556, "youden_j": -0.1325, "cvss_coverage": 1.0, "cvss_tp_weight": 67.4, "cvss_fp_weight": 15.7, "cvss_fn_weight": 79.7, "cvss_precision": 0.811, "cvss_recall": 0.4582, "cvss_f3": 0.479, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 17, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4848, "recall": 0.6154, "f1": 0.5424, "f2": 0.5839, "f2_score": 58.4, "f3": 0.5993, "f3_score": 59.9, "tpr": 0.6154, "fpr": 0.8095, "youden_j": -0.1941, "cvss_coverage": 1.0, "cvss_tp_weight": 94.2, "cvss_fp_weight": 79.0, "cvss_fn_weight": 52.9, "cvss_precision": 0.544, "cvss_recall": 0.6404, "cvss_f3": 0.6292, "cvss_f3_score": 62.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9584, "recall": 0.3654, "f1": 0.5248, "f2": 0.4156, "f2_score": 41.5, "f3": 0.3889, "f3_score": 38.9, "tpr": 0.3654, "fpr": 0.1, "youden_j": 0.2654, "cvss_coverage": 1.0, "cvss_tp_weight": 57.1, "cvss_fp_weight": 2.5, "cvss_fn_weight": 90.0, "cvss_precision": 0.9651, "cvss_recall": 0.3881, "cvss_f3": 0.4123, "cvss_f3_score": 41.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 0, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2692, "f1": 0.4242, "f2": 0.3153, "f2_score": 31.5, "f3": 0.2905, "f3_score": 29.0, "tpr": 0.2692, "fpr": 0.0, "youden_j": 0.2692, "cvss_coverage": 1.0, "cvss_tp_weight": 47.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 99.7, "cvss_precision": 1.0, "cvss_recall": 0.3222, "cvss_f3": 0.3457, "cvss_f3_score": 34.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8931, "recall": 0.5, "f1": 0.6399, "f2": 0.5478, "f2_score": 54.8, "f3": 0.5228, "f3_score": 52.3, "tpr": 0.5, "fpr": 0.254, "youden_j": 0.246, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 3.8, "cvss_fn_weight": 67.5, "cvss_precision": 0.9576, "cvss_recall": 0.5414, "cvss_f3": 0.5658, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7094, "recall": 0.6025, "f1": 0.651, "f2": 0.6209, "f2_score": 62.1, "f3": 0.6116, "f3_score": 61.1, "tpr": 0.6025, "fpr": 0.6121, "youden_j": -0.0096, "cvss_coverage": 1.0, "cvss_tp_weight": 92.8, "cvss_fp_weight": 26.6, "cvss_fn_weight": 54.3, "cvss_precision": 0.7745, "cvss_recall": 0.6306, "cvss_f3": 0.6424, "cvss_f3_score": 64.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 14, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5776, "recall": 0.6667, "f1": 0.6088, "f2": 0.639, "f2_score": 63.9, "f3": 0.6519, "f3_score": 65.2, "tpr": 0.6667, "fpr": 0.7406, "youden_j": -0.074, "cvss_coverage": 1.0, "cvss_tp_weight": 103.2, "cvss_fp_weight": 32.1, "cvss_fn_weight": 43.9, "cvss_precision": 0.7781, "cvss_recall": 0.7016, "cvss_f3": 0.707, "cvss_f3_score": 70.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 13, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5806, "recall": 0.6923, "f1": 0.6316, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6792, "f3_score": 67.9, "tpr": 0.6923, "fpr": 0.8125, "youden_j": -0.1202, "cvss_coverage": 1.0, "cvss_tp_weight": 106.9, "cvss_fp_weight": 41.7, "cvss_fn_weight": 40.2, "cvss_precision": 0.7193, "cvss_recall": 0.7267, "cvss_f3": 0.726, "cvss_f3_score": 72.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 8, "fp": 1, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7178, "recall": 0.5513, "f1": 0.6234, "f2": 0.578, "f2_score": 57.8, "f3": 0.5643, "f3_score": 56.4, "tpr": 0.5513, "fpr": 0.5825, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 88.6, "cvss_fp_weight": 21.9, "cvss_fn_weight": 58.5, "cvss_precision": 0.8019, "cvss_recall": 0.6021, "cvss_f3": 0.6175, "cvss_f3_score": 61.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 10, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.3846, "f1": 0.5128, "f2": 0.4274, "f2_score": 42.7, "f3": 0.4049, "f3_score": 40.5, "tpr": 0.3846, "fpr": 0.4286, "youden_j": -0.044, "cvss_coverage": 1.0, "cvss_tp_weight": 65.4, "cvss_fp_weight": 10.3, "cvss_fn_weight": 81.7, "cvss_precision": 0.8639, "cvss_recall": 0.4446, "cvss_f3": 0.4673, "cvss_f3_score": 46.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 13, "fp": 16, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4483, "recall": 0.5, "f1": 0.4727, "f2": 0.4887, "f2_score": 48.9, "f3": 0.4943, "f3_score": 49.4, "tpr": 0.5, "fpr": 0.8, "youden_j": -0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 84.2, "cvss_fp_weight": 69.6, "cvss_fn_weight": 62.9, "cvss_precision": 0.5473, "cvss_recall": 0.5724, "cvss_f3": 0.5698, "cvss_f3_score": 57.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4615, "f1": 0.5455, "f2": 0.4918, "f2_score": 49.2, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4615, "fpr": 0.6, "youden_j": -0.1385, "cvss_coverage": 1.0, "cvss_tp_weight": 79.3, "cvss_fp_weight": 25.0, "cvss_fn_weight": 67.8, "cvss_precision": 0.7602, "cvss_recall": 0.5391, "cvss_f3": 0.5552, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 12, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4783, "recall": 0.4231, "f1": 0.449, "f2": 0.4331, "f2_score": 43.3, "f3": 0.428, "f3_score": 42.8, "tpr": 0.4231, "fpr": 0.75, "youden_j": -0.3269, "cvss_coverage": 1.0, "cvss_tp_weight": 72.9, "cvss_fp_weight": 58.8, "cvss_fn_weight": 74.2, "cvss_precision": 0.5534, "cvss_recall": 0.4956, "cvss_f3": 0.5008, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 26, "fp": 4, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 1.0, "f1": 0.9286, "f2": 0.9701, "f2_score": 97.0, "f3": 0.9848, "f3_score": 98.5, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 147.1, "cvss_fp_weight": 19.6, "cvss_fn_weight": 0.0, "cvss_precision": 0.8824, "cvss_recall": 1.0, "cvss_f3": 0.9868, "cvss_f3_score": 98.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-071", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-342", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-556", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-636", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7091, "recall": 0.3846, "f1": 0.4926, "f2": 0.421, "f2_score": 42.1, "f3": 0.4019, "f3_score": 40.2, "tpr": 0.3846, "fpr": 0.4899, "youden_j": -0.1053, "cvss_coverage": 1.0, "cvss_tp_weight": 61.3, "cvss_fp_weight": 16.8, "cvss_fn_weight": 85.8, "cvss_precision": 0.7864, "cvss_recall": 0.4167, "cvss_f3": 0.4364, "cvss_f3_score": 43.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 10, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6684, "recall": 0.3974, "f1": 0.4926, "f2": 0.4301, "f2_score": 43.0, "f3": 0.4131, "f3_score": 41.3, "tpr": 0.3974, "fpr": 0.555, "youden_j": -0.1576, "cvss_coverage": 1.0, "cvss_tp_weight": 62.3, "cvss_fp_weight": 18.8, "cvss_fn_weight": 84.8, "cvss_precision": 0.7691, "cvss_recall": 0.4233, "cvss_f3": 0.4427, "cvss_f3_score": 44.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 10, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6369, "recall": 0.3974, "f1": 0.487, "f2": 0.4287, "f2_score": 42.9, "f3": 0.4124, "f3_score": 41.3, "tpr": 0.3974, "fpr": 0.581, "youden_j": -0.1835, "cvss_coverage": 1.0, "cvss_tp_weight": 64.8, "cvss_fp_weight": 14.9, "cvss_fn_weight": 82.3, "cvss_precision": 0.8156, "cvss_recall": 0.4403, "cvss_f3": 0.4615, "cvss_f3_score": 46.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 14, "fp": 10, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.5385, "f1": 0.56, "f2": 0.5469, "f2_score": 54.7, "f3": 0.5426, "f3_score": 54.3, "tpr": 0.5385, "fpr": 0.7143, "youden_j": -0.1758, "cvss_coverage": 1.0, "cvss_tp_weight": 82.4, "cvss_fp_weight": 27.0, "cvss_fn_weight": 64.7, "cvss_precision": 0.7531, "cvss_recall": 0.5602, "cvss_f3": 0.5749, "cvss_f3_score": 57.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 14, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.6154, "f1": 0.5714, "f2": 0.597, "f2_score": 59.7, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.6154, "fpr": 0.8235, "youden_j": -0.2081, "cvss_coverage": 1.0, "cvss_tp_weight": 95.3, "cvss_fp_weight": 65.0, "cvss_fn_weight": 51.8, "cvss_precision": 0.5945, "cvss_recall": 0.6479, "cvss_f3": 0.6421, "cvss_f3_score": 64.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 1, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 18, "fp": 41, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3051, "recall": 0.6923, "f1": 0.4235, "f2": 0.5521, "f2_score": 55.2, "f3": 0.6143, "f3_score": 61.4, "tpr": 0.6923, "fpr": 0.9111, "youden_j": -0.2188, "cvss_coverage": 1.0, "cvss_tp_weight": 104.3, "cvss_fp_weight": 272.0, "cvss_fn_weight": 42.8, "cvss_precision": 0.2772, "cvss_recall": 0.709, "cvss_f3": 0.6135, "cvss_f3_score": 61.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-071", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-179", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 21, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4878, "recall": 0.7692, "f1": 0.597, "f2": 0.6897, "f2_score": 69.0, "f3": 0.7273, "f3_score": 72.7, "tpr": 0.7692, "fpr": 0.84, "youden_j": -0.0708, "cvss_coverage": 1.0, "cvss_tp_weight": 118.3, "cvss_fp_weight": 130.0, "cvss_fn_weight": 28.8, "cvss_precision": 0.4764, "cvss_recall": 0.8042, "cvss_f3": 0.7524, "cvss_f3_score": 75.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-315" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0385, "f1": 0.0741, "f2": 0.0476, "f2_score": 4.8, "f3": 0.0426, "f3_score": 4.3, "tpr": 0.0385, "fpr": 0.0, "youden_j": 0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 6.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 140.6, "cvss_precision": 1.0, "cvss_recall": 0.0442, "cvss_f3": 0.0489, "cvss_f3_score": 4.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-157", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-179", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-262", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-587", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-606", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-617", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 50, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2958, "recall": 0.8077, "f1": 0.433, "f2": 0.6, "f2_score": 60.0, "f3": 0.6885, "f3_score": 68.9, "tpr": 0.8077, "fpr": 0.9434, "youden_j": -0.1357, "cvss_coverage": 1.0, "cvss_tp_weight": 122.4, "cvss_fp_weight": 316.5, "cvss_fn_weight": 24.7, "cvss_precision": 0.2789, "cvss_recall": 0.8321, "cvss_f3": 0.6943, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 9, "fp": 1, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-071", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-556", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-258" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-313" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 5, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8276, "recall": 0.9231, "f1": 0.8727, "f2": 0.9023, "f2_score": 90.2, "f3": 0.9125, "f3_score": 91.3, "tpr": 0.9231, "fpr": 0.5556, "youden_j": 0.3675, "cvss_coverage": 1.0, "cvss_tp_weight": 137.5, "cvss_fp_weight": 40.0, "cvss_fn_weight": 9.6, "cvss_precision": 0.7746, "cvss_recall": 0.9347, "cvss_f3": 0.9158, "cvss_f3_score": 91.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-071", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-342", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-556", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-636", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 22, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4211, "recall": 0.6154, "f1": 0.5, "f2": 0.5634, "f2_score": 56.3, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.6154, "fpr": 0.8462, "youden_j": -0.2308, "cvss_coverage": 1.0, "cvss_tp_weight": 97.3, "cvss_fp_weight": 130.5, "cvss_fn_weight": 49.8, "cvss_precision": 0.4271, "cvss_recall": 0.6615, "cvss_f3": 0.6271, "cvss_f3_score": 62.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-599" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 61, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2651, "recall": 0.8462, "f1": 0.4037, "f2": 0.5882, "f2_score": 58.8, "f3": 0.694, "f3_score": 69.4, "tpr": 0.8462, "fpr": 0.9531, "youden_j": -0.107, "cvss_coverage": 1.0, "cvss_tp_weight": 127.7, "cvss_fp_weight": 379.5, "cvss_fn_weight": 19.4, "cvss_precision": 0.2518, "cvss_recall": 0.8681, "cvss_f3": 0.6974, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9286 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 10, "fp": 1, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-071", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-072", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-204", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-342", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-556", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-626", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-258" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-313" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form_page.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 1, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9091, "recall": 0.3846, "f1": 0.5405, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4082, "f3_score": 40.8, "tpr": 0.3846, "fpr": 0.2, "youden_j": 0.1846, "cvss_coverage": 1.0, "cvss_tp_weight": 63.8, "cvss_fp_weight": 4.9, "cvss_fn_weight": 83.3, "cvss_precision": 0.9286, "cvss_recall": 0.4337, "cvss_f3": 0.4581, "cvss_f3_score": 45.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3571 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-070", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-606", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-157", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-566", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-576", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 147.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-157", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-179", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-262", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-587", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-606", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-617", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 38, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1556, "recall": 0.2692, "f1": 0.1972, "f2": 0.2349, "f2_score": 23.5, "f3": 0.2509, "f3_score": 25.1, "tpr": 0.2692, "fpr": 0.9048, "youden_j": -0.6355, "cvss_coverage": 1.0, "cvss_tp_weight": 43.5, "cvss_fp_weight": 124.5, "cvss_fn_weight": 103.6, "cvss_precision": 0.2589, "cvss_recall": 0.2957, "cvss_f3": 0.2916, "cvss_f3_score": 29.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.1429 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-617", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-297", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-587", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/access.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-157", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-606", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 13, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7647, "youden_j": -0.7647, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 63.7, "cvss_fn_weight": 147.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 14, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/portal/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/portal/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/portal/templates/portal/form_page.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-healthcare-clinic-django/portal/templates/registration/login.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-157", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-179", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-262", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-587", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-598", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-606", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-617", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-646", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 25, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1379, "recall": 0.1538, "f1": 0.1455, "f2": 0.1504, "f2_score": 15.0, "f3": 0.1521, "f3_score": 15.2, "tpr": 0.1538, "fpr": 0.8621, "youden_j": -0.7082, "cvss_coverage": 1.0, "cvss_tp_weight": 25.8, "cvss_fp_weight": 131.8, "cvss_fn_weight": 121.3, "cvss_precision": 0.1637, "cvss_recall": 0.1754, "cvss_f3": 0.1742, "cvss_f3_score": 17.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.0714 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-179", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-262", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-598", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-646", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-070", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-071", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-072", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-157", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-204", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-297", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-342", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-556", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-566", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-576", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-587", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-606", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-617", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-626", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-636", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-287" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-598" } ] } }, "vc-codex-high-seeded-v2-hr-payroll-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 6, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.76, "f1": 0.76, "f2": 0.76, "f2_score": 76.0, "f3": 0.76, "f3_score": 76.0, "tpr": 0.76, "fpr": 0.6, "youden_j": 0.16, "cvss_coverage": 1.0, "cvss_tp_weight": 121.8, "cvss_fp_weight": 27.8, "cvss_fn_weight": 36.8, "cvss_precision": 0.8139, "cvss_recall": 0.768, "cvss_f3": 0.7723, "cvss_f3_score": 77.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-637", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.64, "f1": 0.6957, "f2": 0.6612, "f2_score": 66.1, "f3": 0.6504, "f3_score": 65.0, "tpr": 0.64, "fpr": 0.5556, "youden_j": 0.0844, "cvss_coverage": 1.0, "cvss_tp_weight": 107.3, "cvss_fp_weight": 17.4, "cvss_fn_weight": 51.3, "cvss_precision": 0.8604, "cvss_recall": 0.6765, "cvss_f3": 0.6913, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 3, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.6, "f1": 0.6977, "f2": 0.6356, "f2_score": 63.6, "f3": 0.6173, "f3_score": 61.7, "tpr": 0.6, "fpr": 0.5, "youden_j": 0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 96.7, "cvss_fp_weight": 11.4, "cvss_fn_weight": 61.9, "cvss_precision": 0.8942, "cvss_recall": 0.6097, "cvss_f3": 0.6297, "cvss_f3_score": 63.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 1, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.52, "f1": 0.6667, "f2": 0.5702, "f2_score": 57.0, "f3": 0.5439, "f3_score": 54.4, "tpr": 0.52, "fpr": 0.2, "youden_j": 0.32, "cvss_coverage": 1.0, "cvss_tp_weight": 88.1, "cvss_fp_weight": 0.5, "cvss_fn_weight": 70.5, "cvss_precision": 0.9944, "cvss_recall": 0.5555, "cvss_f3": 0.5811, "cvss_f3_score": 58.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-647", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 10, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 0.76, "f1": 0.7037, "f2": 0.7364, "f2_score": 73.6, "f3": 0.748, "f3_score": 74.8, "tpr": 0.76, "fpr": 0.7143, "youden_j": 0.0457, "cvss_coverage": 1.0, "cvss_tp_weight": 124.0, "cvss_fp_weight": 34.8, "cvss_fn_weight": 34.6, "cvss_precision": 0.7808, "cvss_recall": 0.7818, "cvss_f3": 0.7817, "cvss_f3_score": 78.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-258" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 7, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.28, "f1": 0.3834, "f2": 0.3137, "f2_score": 31.4, "f3": 0.2959, "f3_score": 29.6, "tpr": 0.28, "fpr": 0.1111, "youden_j": 0.1689, "cvss_coverage": 1.0, "cvss_tp_weight": 47.2, "cvss_fp_weight": 2.0, "cvss_fn_weight": 111.4, "cvss_precision": 0.6418, "cvss_recall": 0.2974, "cvss_f3": 0.3141, "cvss_f3_score": 31.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 12, "fp": 0, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.48, "f1": 0.6486, "f2": 0.5357, "f2_score": 53.6, "f3": 0.5063, "f3_score": 50.6, "tpr": 0.48, "fpr": 0.0, "youden_j": 0.48, "cvss_coverage": 1.0, "cvss_tp_weight": 81.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 77.0, "cvss_precision": 1.0, "cvss_recall": 0.5145, "cvss_f3": 0.5408, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9061, "recall": 0.5067, "f1": 0.6494, "f2": 0.5555, "f2_score": 55.5, "f3": 0.5299, "f3_score": 53.0, "tpr": 0.5067, "fpr": 0.2444, "youden_j": 0.2622, "cvss_coverage": 1.0, "cvss_tp_weight": 87.0, "cvss_fp_weight": 7.3, "cvss_fn_weight": 71.6, "cvss_precision": 0.9235, "cvss_recall": 0.5486, "cvss_f3": 0.5717, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 14, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7197, "recall": 0.5467, "f1": 0.6211, "f2": 0.5741, "f2_score": 57.4, "f3": 0.5601, "f3_score": 56.0, "tpr": 0.5467, "fpr": 0.5704, "youden_j": -0.0237, "cvss_coverage": 1.0, "cvss_tp_weight": 91.0, "cvss_fp_weight": 20.9, "cvss_fn_weight": 67.6, "cvss_precision": 0.8135, "cvss_recall": 0.5736, "cvss_f3": 0.591, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7697, "recall": 0.6267, "f1": 0.6889, "f2": 0.6498, "f2_score": 65.0, "f3": 0.638, "f3_score": 63.8, "tpr": 0.6267, "fpr": 0.5085, "youden_j": 0.1181, "cvss_coverage": 1.0, "cvss_tp_weight": 105.1, "cvss_fp_weight": 5.8, "cvss_fn_weight": 53.5, "cvss_precision": 0.9475, "cvss_recall": 0.6625, "cvss_f3": 0.6828, "cvss_f3_score": 68.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 6, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.72, "f1": 0.7347, "f2": 0.7258, "f2_score": 72.6, "f3": 0.7229, "f3_score": 72.3, "tpr": 0.72, "fpr": 0.6, "youden_j": 0.12, "cvss_coverage": 1.0, "cvss_tp_weight": 116.6, "cvss_fp_weight": 27.8, "cvss_fn_weight": 42.0, "cvss_precision": 0.8072, "cvss_recall": 0.7352, "cvss_f3": 0.7418, "cvss_f3_score": 74.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.5867, "f1": 0.6325, "f2": 0.6041, "f2_score": 60.4, "f3": 0.5952, "f3_score": 59.5, "tpr": 0.5867, "fpr": 0.6243, "youden_j": -0.0376, "cvss_coverage": 1.0, "cvss_tp_weight": 98.5, "cvss_fp_weight": 13.2, "cvss_fn_weight": 60.1, "cvss_precision": 0.8811, "cvss_recall": 0.6209, "cvss_f3": 0.6397, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 1, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.56, "f1": 0.7, "f2": 0.6087, "f2_score": 60.9, "f3": 0.5833, "f3_score": 58.3, "tpr": 0.56, "fpr": 0.2, "youden_j": 0.36, "cvss_coverage": 1.0, "cvss_tp_weight": 95.6, "cvss_fp_weight": 5.5, "cvss_fn_weight": 63.0, "cvss_precision": 0.9459, "cvss_recall": 0.6028, "cvss_f3": 0.6255, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 12, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.8, "f1": 0.7018, "f2": 0.7576, "f2_score": 75.8, "f3": 0.7782, "f3_score": 77.8, "tpr": 0.8, "fpr": 0.75, "youden_j": 0.05, "cvss_coverage": 1.0, "cvss_tp_weight": 130.5, "cvss_fp_weight": 60.7, "cvss_fn_weight": 28.1, "cvss_precision": 0.6827, "cvss_recall": 0.8228, "cvss_f3": 0.8063, "cvss_f3_score": 80.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 1, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9375, "recall": 0.6, "f1": 0.7317, "f2": 0.6466, "f2_score": 64.7, "f3": 0.6224, "f3_score": 62.2, "tpr": 0.6, "fpr": 0.2, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 103.0, "cvss_fp_weight": 5.5, "cvss_fn_weight": 55.6, "cvss_precision": 0.9496, "cvss_recall": 0.6494, "cvss_f3": 0.6706, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.52, "f1": 0.5778, "f2": 0.5417, "f2_score": 54.2, "f3": 0.5306, "f3_score": 53.1, "tpr": 0.52, "fpr": 0.6364, "youden_j": -0.1164, "cvss_coverage": 1.0, "cvss_tp_weight": 94.4, "cvss_fp_weight": 33.3, "cvss_fn_weight": 64.2, "cvss_precision": 0.7392, "cvss_recall": 0.5952, "cvss_f3": 0.607, "cvss_f3_score": 60.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-647", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 24, "fp": 11, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6857, "recall": 0.96, "f1": 0.8, "f2": 0.8889, "f2_score": 88.9, "f3": 0.9231, "f3_score": 92.3, "tpr": 0.96, "fpr": 0.7333, "youden_j": 0.2267, "cvss_coverage": 1.0, "cvss_tp_weight": 151.1, "cvss_fp_weight": 55.2, "cvss_fn_weight": 7.5, "cvss_precision": 0.7325, "cvss_recall": 0.9527, "cvss_f3": 0.9249, "cvss_f3_score": 92.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-136", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-557", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-637", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 5, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7316, "recall": 0.4133, "f1": 0.5214, "f2": 0.4499, "f2_score": 45.0, "f3": 0.4307, "f3_score": 43.1, "tpr": 0.4133, "fpr": 0.4476, "youden_j": -0.0343, "cvss_coverage": 1.0, "cvss_tp_weight": 70.4, "cvss_fp_weight": 20.6, "cvss_fn_weight": 88.2, "cvss_precision": 0.8103, "cvss_recall": 0.4439, "cvss_f3": 0.4637, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 1, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9139, "recall": 0.5333, "f1": 0.6724, "f2": 0.5813, "f2_score": 58.1, "f3": 0.5563, "f3_score": 55.6, "tpr": 0.5333, "fpr": 0.2222, "youden_j": 0.3111, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 4.0, "cvss_fn_weight": 68.0, "cvss_precision": 0.9586, "cvss_recall": 0.5713, "cvss_f3": 0.5953, "cvss_f3_score": 59.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-647", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 7, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6508, "recall": 0.5467, "f1": 0.5942, "f2": 0.5647, "f2_score": 56.5, "f3": 0.5556, "f3_score": 55.5, "tpr": 0.5467, "fpr": 0.6445, "youden_j": -0.0978, "cvss_coverage": 1.0, "cvss_tp_weight": 92.0, "cvss_fp_weight": 15.3, "cvss_fn_weight": 66.6, "cvss_precision": 0.8596, "cvss_recall": 0.5803, "cvss_f3": 0.5995, "cvss_f3_score": 60.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 19, "fp": 7, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7308, "recall": 0.76, "f1": 0.7451, "f2": 0.754, "f2_score": 75.4, "f3": 0.757, "f3_score": 75.7, "tpr": 0.76, "fpr": 0.6364, "youden_j": 0.1236, "cvss_coverage": 1.0, "cvss_tp_weight": 122.4, "cvss_fp_weight": 8.5, "cvss_fn_weight": 36.2, "cvss_precision": 0.9353, "cvss_recall": 0.7718, "cvss_f3": 0.7855, "cvss_f3_score": 78.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-136", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 6, "fn": 10, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.6, "f1": 0.6522, "f2": 0.6198, "f2_score": 62.0, "f3": 0.6098, "f3_score": 61.0, "tpr": 0.6, "fpr": 0.6667, "youden_j": -0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 105.2, "cvss_fp_weight": 37.5, "cvss_fn_weight": 53.4, "cvss_precision": 0.7372, "cvss_recall": 0.6633, "cvss_f3": 0.67, "cvss_f3_score": 67.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 1, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 56, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2727, "recall": 0.84, "f1": 0.4118, "f2": 0.5932, "f2_score": 59.3, "f3": 0.6954, "f3_score": 69.5, "tpr": 0.84, "fpr": 0.9492, "youden_j": -0.1092, "cvss_coverage": 1.0, "cvss_tp_weight": 136.0, "cvss_fp_weight": 366.5, "cvss_fn_weight": 22.6, "cvss_precision": 0.2706, "cvss_recall": 0.8575, "cvss_f3": 0.7047, "cvss_f3_score": 70.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 1, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/confirm_delete.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/invite_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/employee_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/api_keys.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-073", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 16, "fp": 35, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3137, "recall": 0.64, "f1": 0.4211, "f2": 0.5298, "f2_score": 53.0, "f3": 0.5797, "f3_score": 58.0, "tpr": 0.64, "fpr": 0.9211, "youden_j": -0.2811, "cvss_coverage": 1.0, "cvss_tp_weight": 105.0, "cvss_fp_weight": 243.0, "cvss_fn_weight": 53.6, "cvss_precision": 0.3017, "cvss_recall": 0.662, "cvss_f3": 0.5914, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-180", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 0, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.12, "f1": 0.2143, "f2": 0.1456, "f2_score": 14.6, "f3": 0.1316, "f3_score": 13.2, "tpr": 0.12, "fpr": 0.0, "youden_j": 0.12, "cvss_coverage": 1.0, "cvss_tp_weight": 19.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 139.0, "cvss_precision": 1.0, "cvss_recall": 0.1236, "cvss_f3": 0.1355, "cvss_f3_score": 13.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-075", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-180", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-588", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-618", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-647", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 47, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3088, "recall": 0.84, "f1": 0.4516, "f2": 0.625, "f2_score": 62.5, "f3": 0.7167, "f3_score": 71.7, "tpr": 0.84, "fpr": 0.9216, "youden_j": -0.0816, "cvss_coverage": 1.0, "cvss_tp_weight": 137.0, "cvss_fp_weight": 328.0, "cvss_fn_weight": 21.6, "cvss_precision": 0.2946, "cvss_recall": 0.8638, "cvss_f3": 0.7239, "cvss_f3_score": 72.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-190" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-136", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-557", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/confirm_delete.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/confirm_delete.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/invite_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 23, "fp": 22, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5111, "recall": 0.92, "f1": 0.6571, "f2": 0.7931, "f2_score": 79.3, "f3": 0.8519, "f3_score": 85.2, "tpr": 0.92, "fpr": 0.88, "youden_j": 0.04, "cvss_coverage": 1.0, "cvss_tp_weight": 147.8, "cvss_fp_weight": 173.5, "cvss_fn_weight": 10.8, "cvss_precision": 0.46, "cvss_recall": 0.9319, "cvss_f3": 0.8452, "cvss_f3_score": 84.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 1, "fn": 1, "recall": 0.9231 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-136", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-557", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-637", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_portal/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_portal/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 5, "fp": 6, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.2, "f1": 0.2778, "f2": 0.2252, "f2_score": 22.5, "f3": 0.2119, "f3_score": 21.2, "tpr": 0.2, "fpr": 0.6, "youden_j": -0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 35.5, "cvss_fp_weight": 38.5, "cvss_fn_weight": 123.1, "cvss_precision": 0.4797, "cvss_recall": 0.2238, "cvss_f3": 0.2364, "cvss_f3_score": 23.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-074", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-075", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-180", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-263", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-588", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-618", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 62, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.253, "recall": 0.84, "f1": 0.3889, "f2": 0.5738, "f2_score": 57.4, "f3": 0.6818, "f3_score": 68.2, "tpr": 0.84, "fpr": 0.9394, "youden_j": -0.0994, "cvss_coverage": 1.0, "cvss_tp_weight": 137.0, "cvss_fp_weight": 408.5, "cvss_fn_weight": 21.6, "cvss_precision": 0.2511, "cvss_recall": 0.8638, "cvss_f3": 0.6944, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-190" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-136", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-350", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-557", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-627", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": "hr_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/urls.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/services.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/confirm_delete.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/confirm_delete.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/form.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/templates/portal/invite_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 13, "fp": 11, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5417, "recall": 0.52, "f1": 0.5306, "f2": 0.5242, "f2_score": 52.4, "f3": 0.5221, "f3_score": 52.2, "tpr": 0.52, "fpr": 0.7333, "youden_j": -0.2133, "cvss_coverage": 1.0, "cvss_tp_weight": 86.8, "cvss_fp_weight": 45.3, "cvss_fn_weight": 71.8, "cvss_precision": 0.6573, "cvss_recall": 0.5473, "cvss_f3": 0.5566, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-595", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-567", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-588", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.44, "f1": 0.5366, "f2": 0.4741, "f2_score": 47.4, "f3": 0.4564, "f3_score": 45.6, "tpr": 0.44, "fpr": 0.5556, "youden_j": -0.1156, "cvss_coverage": 1.0, "cvss_tp_weight": 77.3, "cvss_fp_weight": 27.3, "cvss_fn_weight": 81.3, "cvss_precision": 0.7387, "cvss_recall": 0.4874, "cvss_f3": 0.5046, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 7, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-074", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-607", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-577", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-223", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 36, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1628, "recall": 0.28, "f1": 0.2059, "f2": 0.2448, "f2_score": 24.5, "f3": 0.2612, "f3_score": 26.1, "tpr": 0.28, "fpr": 0.9, "youden_j": -0.62, "cvss_coverage": 1.0, "cvss_tp_weight": 48.0, "cvss_fp_weight": 90.0, "cvss_fn_weight": 110.6, "cvss_precision": 0.3478, "cvss_recall": 0.3026, "cvss_f3": 0.3066, "cvss_f3_score": 30.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.0909 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-618", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-298", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-588", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-074", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 12, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.75, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 65.6, "cvss_fn_weight": 158.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/hr_portal/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/portal/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-hr-payroll-django/portal/templates/portal/form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-074", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-075", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-180", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-263", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-588", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-618", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-647", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 56, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0667, "recall": 0.16, "f1": 0.0941, "f2": 0.125, "f2_score": 12.5, "f3": 0.1404, "f3_score": 14.0, "tpr": 0.16, "fpr": 0.9333, "youden_j": -0.7733, "cvss_coverage": 1.0, "cvss_tp_weight": 28.4, "cvss_fp_weight": 310.3, "cvss_fn_weight": 130.2, "cvss_precision": 0.0839, "cvss_recall": 0.1791, "cvss_f3": 0.1608, "cvss_f3_score": 16.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-075", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-180", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-263", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-647", "file": "hr_portal/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_portal/payroll_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/smoke_check.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-073", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-074", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-136", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-223", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-298", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-350", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-557", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-567", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-577", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-588", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-595", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-607", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-618", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-627", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-637", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-high-seeded-v2-legal-case-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 6, "fp": 20, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2308, "recall": 0.24, "f1": 0.2353, "f2": 0.2381, "f2_score": 23.8, "f3": 0.239, "f3_score": 23.9, "tpr": 0.24, "fpr": 0.8333, "youden_j": -0.5933, "cvss_coverage": 1.0, "cvss_tp_weight": 37.6, "cvss_fp_weight": 121.3, "cvss_fn_weight": 108.0, "cvss_precision": 0.2366, "cvss_recall": 0.2582, "cvss_f3": 0.2559, "cvss_f3_score": 25.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 5, "fp": 20, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.2, "f1": 0.2, "f2": 0.2, "f2_score": 20.0, "f3": 0.2, "f3_score": 20.0, "tpr": 0.2, "fpr": 0.8333, "youden_j": -0.6333, "cvss_coverage": 1.0, "cvss_tp_weight": 33.0, "cvss_fp_weight": 87.9, "cvss_fn_weight": 112.6, "cvss_precision": 0.2729, "cvss_recall": 0.2266, "cvss_f3": 0.2306, "cvss_f3_score": 23.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 6, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.52, "f1": 0.5909, "f2": 0.5462, "f2_score": 54.6, "f3": 0.5328, "f3_score": 53.3, "tpr": 0.52, "fpr": 0.6667, "youden_j": -0.1467, "cvss_coverage": 1.0, "cvss_tp_weight": 77.5, "cvss_fp_weight": 14.1, "cvss_fn_weight": 68.1, "cvss_precision": 0.8458, "cvss_recall": 0.5323, "cvss_f3": 0.5528, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 1, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 1, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9231, "recall": 0.48, "f1": 0.6316, "f2": 0.531, "f2_score": 53.1, "f3": 0.5042, "f3_score": 50.4, "tpr": 0.48, "fpr": 0.2, "youden_j": 0.28, "cvss_coverage": 1.0, "cvss_tp_weight": 67.7, "cvss_fp_weight": 6.1, "cvss_fn_weight": 77.9, "cvss_precision": 0.9178, "cvss_recall": 0.465, "cvss_f3": 0.4891, "cvss_f3_score": 48.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 5, "fp": 27, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1562, "recall": 0.2, "f1": 0.1754, "f2": 0.1894, "f2_score": 18.9, "f3": 0.1946, "f3_score": 19.5, "tpr": 0.2, "fpr": 0.871, "youden_j": -0.671, "cvss_coverage": 1.0, "cvss_tp_weight": 33.0, "cvss_fp_weight": 147.1, "cvss_fn_weight": 112.6, "cvss_precision": 0.1833, "cvss_recall": 0.2266, "cvss_f3": 0.2214, "cvss_f3_score": 22.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 8, "fp": 0, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.32, "f1": 0.4834, "f2": 0.37, "f2_score": 37.0, "f3": 0.3432, "f3_score": 34.4, "tpr": 0.32, "fpr": 0.0, "youden_j": 0.32, "cvss_coverage": 1.0, "cvss_tp_weight": 49.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 96.5, "cvss_precision": 1.0, "cvss_recall": 0.3372, "cvss_f3": 0.361, "cvss_f3_score": 36.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 0, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.32, "f1": 0.4848, "f2": 0.3704, "f2_score": 37.0, "f3": 0.3433, "f3_score": 34.3, "tpr": 0.32, "fpr": 0.0, "youden_j": 0.32, "cvss_coverage": 1.0, "cvss_tp_weight": 52.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 93.2, "cvss_precision": 1.0, "cvss_recall": 0.3599, "cvss_f3": 0.3845, "cvss_f3_score": 38.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8154, "recall": 0.4667, "f1": 0.593, "f2": 0.51, "f2_score": 51.0, "f3": 0.4874, "f3_score": 48.7, "tpr": 0.4667, "fpr": 0.3968, "youden_j": 0.0698, "cvss_coverage": 1.0, "cvss_tp_weight": 68.9, "cvss_fp_weight": 8.8, "cvss_fn_weight": 76.7, "cvss_precision": 0.8895, "cvss_recall": 0.473, "cvss_f3": 0.496, "cvss_f3_score": 49.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7507, "recall": 0.6267, "f1": 0.6824, "f2": 0.6477, "f2_score": 64.8, "f3": 0.637, "f3_score": 63.7, "tpr": 0.6267, "fpr": 0.5556, "youden_j": 0.0711, "cvss_coverage": 1.0, "cvss_tp_weight": 95.0, "cvss_fp_weight": 23.1, "cvss_fn_weight": 50.6, "cvss_precision": 0.8137, "cvss_recall": 0.6527, "cvss_f3": 0.6655, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 7, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7022, "recall": 0.6267, "f1": 0.6622, "f2": 0.6404, "f2_score": 64.1, "f3": 0.6335, "f3_score": 63.3, "tpr": 0.6267, "fpr": 0.6196, "youden_j": 0.0071, "cvss_coverage": 1.0, "cvss_tp_weight": 92.0, "cvss_fp_weight": 21.9, "cvss_fn_weight": 53.6, "cvss_precision": 0.8102, "cvss_recall": 0.6316, "cvss_f3": 0.6456, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-11" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 6, "fp": 21, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.24, "f1": 0.2308, "f2": 0.2362, "f2_score": 23.6, "f3": 0.2381, "f3_score": 23.8, "tpr": 0.24, "fpr": 0.84, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 41.8, "cvss_fp_weight": 105.1, "cvss_fn_weight": 103.8, "cvss_precision": 0.2845, "cvss_recall": 0.2871, "cvss_f3": 0.2868, "cvss_f3_score": 28.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 5, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7573, "recall": 0.6667, "f1": 0.7075, "f2": 0.6821, "f2_score": 68.2, "f3": 0.6742, "f3_score": 67.4, "tpr": 0.6667, "fpr": 0.5704, "youden_j": 0.0963, "cvss_coverage": 1.0, "cvss_tp_weight": 99.8, "cvss_fp_weight": 24.9, "cvss_fn_weight": 45.8, "cvss_precision": 0.7988, "cvss_recall": 0.6852, "cvss_f3": 0.6951, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 3, "fp": 10, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2308, "recall": 0.12, "f1": 0.1579, "f2": 0.1327, "f2_score": 13.3, "f3": 0.1261, "f3_score": 12.6, "tpr": 0.12, "fpr": 0.7143, "youden_j": -0.5943, "cvss_coverage": 1.0, "cvss_tp_weight": 16.1, "cvss_fp_weight": 55.1, "cvss_fn_weight": 129.5, "cvss_precision": 0.2262, "cvss_recall": 0.1106, "cvss_f3": 0.1165, "cvss_f3_score": 11.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 9, "fp": 25, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2647, "recall": 0.36, "f1": 0.3051, "f2": 0.3358, "f2_score": 33.6, "f3": 0.3475, "f3_score": 34.7, "tpr": 0.36, "fpr": 0.8621, "youden_j": -0.5021, "cvss_coverage": 1.0, "cvss_tp_weight": 57.5, "cvss_fp_weight": 118.2, "cvss_fn_weight": 88.1, "cvss_precision": 0.3272, "cvss_recall": 0.3949, "cvss_f3": 0.3869, "cvss_f3_score": 38.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/form_page.html", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 4, "fp": 14, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.16, "f1": 0.186, "f2": 0.1695, "f2_score": 16.9, "f3": 0.1646, "f3_score": 16.5, "tpr": 0.16, "fpr": 0.7778, "youden_j": -0.6178, "cvss_coverage": 1.0, "cvss_tp_weight": 25.9, "cvss_fp_weight": 73.8, "cvss_fn_weight": 119.7, "cvss_precision": 0.2598, "cvss_recall": 0.1779, "cvss_f3": 0.1837, "cvss_f3_score": 18.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 4, "fp": 13, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2353, "recall": 0.16, "f1": 0.1905, "f2": 0.1709, "f2_score": 17.1, "f3": 0.1653, "f3_score": 16.5, "tpr": 0.16, "fpr": 0.7647, "youden_j": -0.6047, "cvss_coverage": 1.0, "cvss_tp_weight": 24.0, "cvss_fp_weight": 73.3, "cvss_fn_weight": 121.6, "cvss_precision": 0.2467, "cvss_recall": 0.1648, "cvss_f3": 0.1705, "cvss_f3_score": 17.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 8, "fp": 25, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2424, "recall": 0.32, "f1": 0.2759, "f2": 0.3008, "f2_score": 30.1, "f3": 0.3101, "f3_score": 31.0, "tpr": 0.32, "fpr": 0.8621, "youden_j": -0.5421, "cvss_coverage": 1.0, "cvss_tp_weight": 50.0, "cvss_fp_weight": 134.9, "cvss_fn_weight": 95.6, "cvss_precision": 0.2704, "cvss_recall": 0.3434, "cvss_f3": 0.3344, "cvss_f3_score": 33.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/authz.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 10, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7817, "recall": 0.4, "f1": 0.5273, "f2": 0.4426, "f2_score": 44.2, "f3": 0.4202, "f3_score": 42.0, "tpr": 0.4, "fpr": 0.3947, "youden_j": 0.0053, "cvss_coverage": 1.0, "cvss_tp_weight": 61.9, "cvss_fp_weight": 10.8, "cvss_fn_weight": 83.7, "cvss_precision": 0.8556, "cvss_recall": 0.4253, "cvss_f3": 0.4477, "cvss_f3_score": 44.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 11, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6734, "recall": 0.4533, "f1": 0.5392, "f2": 0.4838, "f2_score": 48.4, "f3": 0.468, "f3_score": 46.8, "tpr": 0.4533, "fpr": 0.5741, "youden_j": -0.1208, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 15.8, "cvss_fn_weight": 73.8, "cvss_precision": 0.8274, "cvss_recall": 0.4929, "cvss_f3": 0.5132, "cvss_f3_score": 51.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 4, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7279, "recall": 0.48, "f1": 0.5784, "f2": 0.515, "f2_score": 51.5, "f3": 0.4969, "f3_score": 49.7, "tpr": 0.48, "fpr": 0.5278, "youden_j": -0.0478, "cvss_coverage": 1.0, "cvss_tp_weight": 75.5, "cvss_fp_weight": 10.6, "cvss_fn_weight": 70.0, "cvss_precision": 0.878, "cvss_recall": 0.5189, "cvss_f3": 0.541, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-638", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 6, "fp": 19, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.24, "recall": 0.24, "f1": 0.24, "f2": 0.24, "f2_score": 24.0, "f3": 0.24, "f3_score": 24.0, "tpr": 0.24, "fpr": 0.8261, "youden_j": -0.5861, "cvss_coverage": 1.0, "cvss_tp_weight": 37.6, "cvss_fp_weight": 81.9, "cvss_fn_weight": 108.0, "cvss_precision": 0.3148, "cvss_recall": 0.2582, "cvss_f3": 0.263, "cvss_f3_score": 26.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 6, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.64, "f1": 0.6809, "f2": 0.6557, "f2_score": 65.6, "f3": 0.6478, "f3_score": 64.8, "tpr": 0.64, "fpr": 0.6, "youden_j": 0.04, "cvss_coverage": 1.0, "cvss_tp_weight": 95.5, "cvss_fp_weight": 37.5, "cvss_fn_weight": 50.1, "cvss_precision": 0.718, "cvss_recall": 0.6559, "cvss_f3": 0.6616, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 17, "fp": 48, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2615, "recall": 0.68, "f1": 0.3778, "f2": 0.5152, "f2_score": 51.5, "f3": 0.5862, "f3_score": 58.6, "tpr": 0.68, "fpr": 0.9412, "youden_j": -0.2612, "cvss_coverage": 1.0, "cvss_tp_weight": 91.9, "cvss_fp_weight": 339.5, "cvss_fn_weight": 53.7, "cvss_precision": 0.213, "cvss_recall": 0.6312, "cvss_f3": 0.5276, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 1, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-682" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-558", "file": "legalcase/case_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-754" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 14, "fp": 40, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2593, "recall": 0.56, "f1": 0.3544, "f2": 0.4545, "f2_score": 45.5, "f3": 0.5018, "f3_score": 50.2, "tpr": 0.56, "fpr": 0.9091, "youden_j": -0.3491, "cvss_coverage": 1.0, "cvss_tp_weight": 86.0, "cvss_fp_weight": 255.5, "cvss_fn_weight": 59.6, "cvss_precision": 0.2518, "cvss_recall": 0.5907, "cvss_f3": 0.5206, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-775" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-524" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-137", "file": "legalcase/case_operations.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.08, "f1": 0.1481, "f2": 0.098, "f2_score": 9.8, "f3": 0.0881, "f3_score": 8.8, "tpr": 0.08, "fpr": 0.0, "youden_j": 0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 17.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 128.0, "cvss_precision": 1.0, "cvss_recall": 0.1209, "cvss_f3": 0.1325, "cvss_f3_score": 13.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 22, "fp": 39, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3607, "recall": 0.88, "f1": 0.5116, "f2": 0.6832, "f2_score": 68.3, "f3": 0.7692, "f3_score": 76.9, "tpr": 0.88, "fpr": 0.907, "youden_j": -0.027, "cvss_coverage": 1.0, "cvss_tp_weight": 129.5, "cvss_fp_weight": 254.0, "cvss_fn_weight": 16.1, "cvss_precision": 0.3377, "cvss_recall": 0.8894, "cvss_f3": 0.7645, "cvss_f3_score": 76.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-137", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-628", "file": "legalcase/case_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py... wait, this is in views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 8, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7576, "recall": 1.0, "f1": 0.8621, "f2": 0.9398, "f2_score": 94.0, "f3": 0.969, "f3_score": 96.9, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 145.6, "cvss_fp_weight": 54.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.7295, "cvss_recall": 1.0, "cvss_f3": 0.9642, "cvss_f3_score": 96.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-137", "file": "legalcase/case_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-558", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-628", "file": "legalcase/case_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-638", "file": "legalcase/case_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 12, "fp": 16, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.48, "f1": 0.4528, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4743, "f3_score": 47.4, "tpr": 0.48, "fpr": 0.8, "youden_j": -0.32, "cvss_coverage": 1.0, "cvss_tp_weight": 73.8, "cvss_fp_weight": 101.0, "cvss_fn_weight": 71.8, "cvss_precision": 0.4222, "cvss_recall": 0.5069, "cvss_f3": 0.4969, "cvss_f3_score": 49.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 43, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3385, "recall": 0.88, "f1": 0.4889, "f2": 0.6667, "f2_score": 66.7, "f3": 0.7586, "f3_score": 75.9, "tpr": 0.88, "fpr": 0.9149, "youden_j": -0.0349, "cvss_coverage": 1.0, "cvss_tp_weight": 129.5, "cvss_fp_weight": 285.0, "cvss_fn_weight": 16.1, "cvss_precision": 0.3124, "cvss_recall": 0.8894, "cvss_f3": 0.7508, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/form_page.html", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-137", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-351", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-628", "file": "legalcase/case_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py... wait, this is in views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/views.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 0, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.36, "f1": 0.5294, "f2": 0.4128, "f2_score": 41.3, "f3": 0.3846, "f3_score": 38.5, "tpr": 0.36, "fpr": 0.0, "youden_j": 0.36, "cvss_coverage": 1.0, "cvss_tp_weight": 62.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 83.5, "cvss_precision": 1.0, "cvss_recall": 0.4265, "cvss_f3": 0.4525, "cvss_f3_score": 45.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 11, "fp": 7, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.44, "f1": 0.5116, "f2": 0.4661, "f2_score": 46.6, "f3": 0.4527, "f3_score": 45.3, "tpr": 0.44, "fpr": 0.7, "youden_j": -0.26, "cvss_coverage": 1.0, "cvss_tp_weight": 69.5, "cvss_fp_weight": 31.3, "cvss_fn_weight": 76.1, "cvss_precision": 0.6893, "cvss_recall": 0.4773, "cvss_f3": 0.4925, "cvss_f3_score": 49.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 1, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-224", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 8, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.52, "f1": 0.5652, "f2": 0.5372, "f2_score": 53.7, "f3": 0.5285, "f3_score": 52.8, "tpr": 0.52, "fpr": 0.6667, "youden_j": -0.1467, "cvss_coverage": 1.0, "cvss_tp_weight": 76.8, "cvss_fp_weight": 37.4, "cvss_fn_weight": 68.8, "cvss_precision": 0.6725, "cvss_recall": 0.5275, "cvss_f3": 0.5391, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-589", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-608", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-568", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-83" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-077", "file": "legalcase/case_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-078", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-578", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-315" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 28, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1515, "recall": 0.2, "f1": 0.1724, "f2": 0.188, "f2_score": 18.8, "f3": 0.1938, "f3_score": 19.4, "tpr": 0.2, "fpr": 0.875, "youden_j": -0.675, "cvss_coverage": 1.0, "cvss_tp_weight": 32.0, "cvss_fp_weight": 99.5, "cvss_fn_weight": 113.6, "cvss_precision": 0.2433, "cvss_recall": 0.2198, "cvss_f3": 0.2219, "cvss_f3_score": 22.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-619", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-299", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 13, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7647, "youden_j": -0.7647, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 78.9, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/cases/management/commands/seed_legal_data.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/cases/templates/cases/matter_detail.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/cases/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-076", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-181", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-264", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-599", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-648", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 59, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0781, "recall": 0.2, "f1": 0.1124, "f2": 0.1524, "f2_score": 15.2, "f3": 0.173, "f3_score": 17.3, "tpr": 0.2, "fpr": 0.9365, "youden_j": -0.7365, "cvss_coverage": 1.0, "cvss_tp_weight": 29.5, "cvss_fp_weight": 364.7, "cvss_fn_weight": 116.1, "cvss_precision": 0.0748, "cvss_recall": 0.2026, "cvss_f3": 0.1731, "cvss_f3_score": 17.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-563" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-1100" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-563" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_legal_data.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-076", "file": "legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-181", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-264", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-599", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-648", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-297" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-077", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-078", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-137", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-224", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-299", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-351", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-558", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-568", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-578", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-589", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-608", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-619", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-628", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-638", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-high-seeded-v2-logistics-dispatch-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 18, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5385, "recall": 0.7241, "f1": 0.6176, "f2": 0.6774, "f2_score": 67.7, "f3": 0.7, "f3_score": 70.0, "tpr": 0.7241, "fpr": 0.8182, "youden_j": -0.094, "cvss_coverage": 1.0, "cvss_tp_weight": 130.8, "cvss_fp_weight": 64.2, "cvss_fn_weight": 37.2, "cvss_precision": 0.6707, "cvss_recall": 0.7786, "cvss_f3": 0.7662, "cvss_f3_score": 76.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-639", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.76, "recall": 0.6552, "f1": 0.7037, "f2": 0.6738, "f2_score": 67.4, "f3": 0.6643, "f3_score": 66.4, "tpr": 0.6552, "fpr": 0.6, "youden_j": 0.0552, "cvss_coverage": 1.0, "cvss_tp_weight": 121.8, "cvss_fp_weight": 8.0, "cvss_fn_weight": 46.2, "cvss_precision": 0.9382, "cvss_recall": 0.725, "cvss_f3": 0.7419, "cvss_f3_score": 74.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-138", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5172, "f1": 0.6383, "f2": 0.5597, "f2_score": 56.0, "f3": 0.5376, "f3_score": 53.8, "tpr": 0.5172, "fpr": 0.4286, "youden_j": 0.0887, "cvss_coverage": 1.0, "cvss_tp_weight": 97.9, "cvss_fp_weight": 11.5, "cvss_fn_weight": 70.1, "cvss_precision": 0.8945, "cvss_recall": 0.5827, "cvss_f3": 0.6038, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.5517, "f1": 0.6667, "f2": 0.5926, "f2_score": 59.3, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5517, "fpr": 0.4286, "youden_j": 0.1232, "cvss_coverage": 1.0, "cvss_tp_weight": 107.7, "cvss_fp_weight": 11.5, "cvss_fn_weight": 60.3, "cvss_precision": 0.9032, "cvss_recall": 0.6411, "cvss_f3": 0.6602, "cvss_f3_score": 66.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 12, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6129, "recall": 0.6552, "f1": 0.6333, "f2": 0.6463, "f2_score": 64.6, "f3": 0.6507, "f3_score": 65.1, "tpr": 0.6552, "fpr": 0.75, "youden_j": -0.0948, "cvss_coverage": 1.0, "cvss_tp_weight": 120.4, "cvss_fp_weight": 61.2, "cvss_fn_weight": 47.6, "cvss_precision": 0.6629, "cvss_recall": 0.7167, "cvss_f3": 0.7109, "cvss_f3_score": 71.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8814, "recall": 0.3793, "f1": 0.5302, "f2": 0.4281, "f2_score": 42.8, "f3": 0.4022, "f3_score": 40.2, "tpr": 0.3793, "fpr": 0.2666, "youden_j": 0.1127, "cvss_coverage": 1.0, "cvss_tp_weight": 75.4, "cvss_fp_weight": 8.2, "cvss_fn_weight": 92.6, "cvss_precision": 0.9021, "cvss_recall": 0.4488, "cvss_f3": 0.4725, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 12, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9231, "recall": 0.4138, "f1": 0.5714, "f2": 0.4651, "f2_score": 46.5, "f3": 0.438, "f3_score": 43.8, "tpr": 0.4138, "fpr": 0.2, "youden_j": 0.2138, "cvss_coverage": 1.0, "cvss_tp_weight": 81.8, "cvss_fp_weight": 5.5, "cvss_fn_weight": 86.2, "cvss_precision": 0.9368, "cvss_recall": 0.4869, "cvss_f3": 0.5115, "cvss_f3_score": 51.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 168.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 168.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 168.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 15, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5588, "recall": 0.6552, "f1": 0.6032, "f2": 0.6333, "f2_score": 63.3, "f3": 0.6441, "f3_score": 64.4, "tpr": 0.6552, "fpr": 0.7895, "youden_j": -0.1343, "cvss_coverage": 1.0, "cvss_tp_weight": 119.0, "cvss_fp_weight": 42.6, "cvss_fn_weight": 49.0, "cvss_precision": 0.7362, "cvss_recall": 0.7083, "cvss_f3": 0.711, "cvss_f3_score": 71.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6599, "recall": 0.6207, "f1": 0.6394, "f2": 0.628, "f2_score": 62.8, "f3": 0.6243, "f3_score": 62.4, "tpr": 0.6207, "fpr": 0.6974, "youden_j": -0.0767, "cvss_coverage": 1.0, "cvss_tp_weight": 116.3, "cvss_fp_weight": 31.4, "cvss_fn_weight": 51.7, "cvss_precision": 0.7885, "cvss_recall": 0.6923, "cvss_f3": 0.7007, "cvss_f3_score": 70.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.5517, "f1": 0.6667, "f2": 0.5926, "f2_score": 59.3, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5517, "fpr": 0.4286, "youden_j": 0.1232, "cvss_coverage": 1.0, "cvss_tp_weight": 105.4, "cvss_fp_weight": 6.5, "cvss_fn_weight": 62.6, "cvss_precision": 0.9417, "cvss_recall": 0.6274, "cvss_f3": 0.649, "cvss_f3_score": 64.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 13, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6905, "recall": 1.0, "f1": 0.8169, "f2": 0.9177, "f2_score": 91.8, "f3": 0.9571, "f3_score": 95.7, "tpr": 1.0, "fpr": 0.7647, "youden_j": 0.2353, "cvss_coverage": 1.0, "cvss_tp_weight": 168.0, "cvss_fp_weight": 61.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.7313, "cvss_recall": 1.0, "cvss_f3": 0.9646, "cvss_f3_score": 96.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-138", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-559", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-639", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/authz.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5172, "f1": 0.6383, "f2": 0.5597, "f2_score": 56.0, "f3": 0.5376, "f3_score": 53.8, "tpr": 0.5172, "fpr": 0.4286, "youden_j": 0.0887, "cvss_coverage": 1.0, "cvss_tp_weight": 100.0, "cvss_fp_weight": 11.5, "cvss_fn_weight": 68.0, "cvss_precision": 0.8965, "cvss_recall": 0.5952, "cvss_f3": 0.6159, "cvss_f3_score": 61.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 9, "fp": 10, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4737, "recall": 0.3103, "f1": 0.375, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3214, "f3_score": 32.1, "tpr": 0.3103, "fpr": 0.7143, "youden_j": -0.4039, "cvss_coverage": 1.0, "cvss_tp_weight": 57.9, "cvss_fp_weight": 45.2, "cvss_fn_weight": 110.1, "cvss_precision": 0.5618, "cvss_recall": 0.3446, "cvss_f3": 0.3585, "cvss_f3_score": 35.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 12, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6471, "recall": 0.7586, "f1": 0.6984, "f2": 0.7333, "f2_score": 73.3, "f3": 0.7458, "f3_score": 74.6, "tpr": 0.7586, "fpr": 0.75, "youden_j": 0.0086, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 51.2, "cvss_fn_weight": 32.7, "cvss_precision": 0.7255, "cvss_recall": 0.8054, "cvss_f3": 0.7966, "cvss_f3_score": 79.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8271, "recall": 0.4713, "f1": 0.5927, "f2": 0.5123, "f2_score": 51.3, "f3": 0.4908, "f3_score": 49.1, "tpr": 0.4713, "fpr": 0.4111, "youden_j": 0.0602, "cvss_coverage": 1.0, "cvss_tp_weight": 89.4, "cvss_fp_weight": 11.7, "cvss_fn_weight": 78.6, "cvss_precision": 0.8942, "cvss_recall": 0.532, "cvss_f3": 0.5534, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 16, "fp": 7, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7055, "recall": 0.5517, "f1": 0.6181, "f2": 0.5763, "f2_score": 57.6, "f3": 0.5637, "f3_score": 56.3, "tpr": 0.5517, "fpr": 0.6243, "youden_j": -0.0725, "cvss_coverage": 1.0, "cvss_tp_weight": 104.1, "cvss_fp_weight": 11.7, "cvss_fn_weight": 63.9, "cvss_precision": 0.8983, "cvss_recall": 0.6194, "cvss_f3": 0.6391, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7405, "recall": 0.5862, "f1": 0.6541, "f2": 0.6115, "f2_score": 61.2, "f3": 0.5986, "f3_score": 59.9, "tpr": 0.5862, "fpr": 0.596, "youden_j": -0.0097, "cvss_coverage": 1.0, "cvss_tp_weight": 108.8, "cvss_fp_weight": 15.6, "cvss_fn_weight": 59.2, "cvss_precision": 0.8751, "cvss_recall": 0.6476, "cvss_f3": 0.6649, "cvss_f3_score": 66.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 7, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.72, "recall": 0.6207, "f1": 0.6667, "f2": 0.6383, "f2_score": 63.8, "f3": 0.6294, "f3_score": 62.9, "tpr": 0.6207, "fpr": 0.6364, "youden_j": -0.0157, "cvss_coverage": 1.0, "cvss_tp_weight": 116.3, "cvss_fp_weight": 13.5, "cvss_fn_weight": 51.7, "cvss_precision": 0.8957, "cvss_recall": 0.6923, "cvss_f3": 0.7084, "cvss_f3_score": 70.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 14, "fp": 16, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.4828, "f1": 0.4746, "f2": 0.4795, "f2_score": 47.9, "f3": 0.4811, "f3_score": 48.1, "tpr": 0.4828, "fpr": 0.8, "youden_j": -0.3172, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 101.0, "cvss_fn_weight": 75.4, "cvss_precision": 0.4783, "cvss_recall": 0.5512, "cvss_f3": 0.5429, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 24, "fp": 51, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.32, "recall": 0.8276, "f1": 0.4615, "f2": 0.6283, "f2_score": 62.8, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.8276, "fpr": 0.9273, "youden_j": -0.0997, "cvss_coverage": 1.0, "cvss_tp_weight": 142.7, "cvss_fp_weight": 329.0, "cvss_fn_weight": 25.3, "cvss_precision": 0.3025, "cvss_recall": 0.8494, "cvss_f3": 0.7194, "cvss_f3_score": 71.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 3, "recall": 0.8235 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 17, "fp": 34, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.5862, "f1": 0.425, "f2": 0.509, "f2_score": 50.9, "f3": 0.5449, "f3_score": 54.5, "tpr": 0.5862, "fpr": 0.8947, "youden_j": -0.3085, "cvss_coverage": 1.0, "cvss_tp_weight": 103.1, "cvss_fp_weight": 244.5, "cvss_fn_weight": 64.9, "cvss_precision": 0.2966, "cvss_recall": 0.6137, "cvss_f3": 0.5544, "cvss_f3_score": 55.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.069, "f1": 0.129, "f2": 0.0847, "f2_score": 8.5, "f3": 0.076, "f3_score": 7.6, "tpr": 0.069, "fpr": 0.0, "youden_j": 0.069, "cvss_coverage": 1.0, "cvss_tp_weight": 12.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 155.7, "cvss_precision": 1.0, "cvss_recall": 0.0732, "cvss_f3": 0.0807, "cvss_f3_score": 8.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 16, "recall": 0.0588 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 18, "fp": 23, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.439, "recall": 0.6207, "f1": 0.5143, "f2": 0.5732, "f2_score": 57.3, "f3": 0.596, "f3_score": 59.6, "tpr": 0.6207, "fpr": 0.8519, "youden_j": -0.2312, "cvss_coverage": 1.0, "cvss_tp_weight": 114.0, "cvss_fp_weight": 163.0, "cvss_fn_weight": 54.0, "cvss_precision": 0.4116, "cvss_recall": 0.6786, "cvss_f3": 0.6372, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-190" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-138", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 12, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.9655, "f1": 0.8116, "f2": 0.8974, "f2_score": 89.7, "f3": 0.9302, "f3_score": 93.0, "tpr": 0.9655, "fpr": 0.75, "youden_j": 0.2155, "cvss_coverage": 1.0, "cvss_tp_weight": 161.5, "cvss_fp_weight": 91.0, "cvss_fn_weight": 6.5, "cvss_precision": 0.6396, "cvss_recall": 0.9613, "cvss_f3": 0.9153, "cvss_f3_score": 91.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-138", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-559", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-639", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 17, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5862, "f1": 0.5397, "f2": 0.5667, "f2_score": 56.7, "f3": 0.5763, "f3_score": 57.6, "tpr": 0.5862, "fpr": 0.8095, "youden_j": -0.2233, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 108.5, "cvss_fn_weight": 66.0, "cvss_precision": 0.4846, "cvss_recall": 0.6071, "cvss_f3": 0.5922, "cvss_f3_score": 59.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 18, "fp": 26, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4091, "recall": 0.6207, "f1": 0.4932, "f2": 0.5625, "f2_score": 56.2, "f3": 0.5902, "f3_score": 59.0, "tpr": 0.6207, "fpr": 0.8667, "youden_j": -0.246, "cvss_coverage": 1.0, "cvss_tp_weight": 114.0, "cvss_fp_weight": 184.5, "cvss_fn_weight": 54.0, "cvss_precision": 0.3819, "cvss_recall": 0.6786, "cvss_f3": 0.6297, "cvss_f3_score": 63.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-079", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-080", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-190" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-138", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-312", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-569", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-579", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-609", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" } ] }, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 11, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7333, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 60.7, "cvss_fn_weight": 168.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 8, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.4138, "f1": 0.4898, "f2": 0.4412, "f2_score": 44.1, "f3": 0.427, "f3_score": 42.7, "tpr": 0.4138, "fpr": 0.6667, "youden_j": -0.2529, "cvss_coverage": 1.0, "cvss_tp_weight": 81.0, "cvss_fp_weight": 44.2, "cvss_fn_weight": 87.0, "cvss_precision": 0.6471, "cvss_recall": 0.4821, "cvss_f3": 0.4948, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-138" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-596", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-241", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 12, "fp": 22, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3529, "recall": 0.4138, "f1": 0.381, "f2": 0.4, "f2_score": 40.0, "f3": 0.4068, "f3_score": 40.7, "tpr": 0.4138, "fpr": 0.8462, "youden_j": -0.4324, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 108.5, "cvss_fn_weight": 93.5, "cvss_precision": 0.4071, "cvss_recall": 0.4435, "cvss_f3": 0.4395, "cvss_f3_score": 44.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-584", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-327", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-615", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_authorization_workflow.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 10, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7143, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 50.2, "cvss_fn_weight": 168.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-logistics-dispatch-fastapi/backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-081", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-182", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-265", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-629", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-649", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 13, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3158, "recall": 0.2069, "f1": 0.25, "f2": 0.2222, "f2_score": 22.2, "f3": 0.2143, "f3_score": 21.4, "tpr": 0.2069, "fpr": 0.7647, "youden_j": -0.5578, "cvss_coverage": 1.0, "cvss_tp_weight": 42.7, "cvss_fp_weight": 79.7, "cvss_fn_weight": 125.3, "cvss_precision": 0.3488, "cvss_recall": 0.2542, "cvss_f3": 0.2613, "cvss_f3_score": 26.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-081", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-182", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-265", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-629", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-649", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_authorization_workflow.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-079", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-080", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-138", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-241", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-312", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-327", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-559", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-569", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-579", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-584", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-596", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-609", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-615", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-639", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-312" } ] } }, "vc-codex-high-seeded-v2-marketplace-commerce-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 15, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.8, "f1": 0.6667, "f2": 0.7407, "f2_score": 74.1, "f3": 0.7692, "f3_score": 76.9, "tpr": 0.8, "fpr": 0.7895, "youden_j": 0.0105, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 89.8, "cvss_fn_weight": 24.1, "cvss_precision": 0.575, "cvss_recall": 0.8345, "cvss_f3": 0.7985, "cvss_f3_score": 79.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-640", "file": "backend/app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 2, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.64, "f1": 0.7442, "f2": 0.678, "f2_score": 67.8, "f3": 0.6584, "f3_score": 65.8, "tpr": 0.64, "fpr": 0.3333, "youden_j": 0.3067, "cvss_coverage": 1.0, "cvss_tp_weight": 103.9, "cvss_fp_weight": 1.0, "cvss_fn_weight": 41.7, "cvss_precision": 0.9905, "cvss_recall": 0.7136, "cvss_f3": 0.7341, "cvss_f3_score": 73.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 4, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.64, "f1": 0.7111, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6531, "f3_score": 65.3, "tpr": 0.64, "fpr": 0.5, "youden_j": 0.14, "cvss_coverage": 1.0, "cvss_tp_weight": 104.6, "cvss_fp_weight": 23.9, "cvss_fn_weight": 41.0, "cvss_precision": 0.8137, "cvss_recall": 0.7184, "cvss_f3": 0.7269, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.44, "f1": 0.5366, "f2": 0.4741, "f2_score": 47.4, "f3": 0.4564, "f3_score": 45.6, "tpr": 0.44, "fpr": 0.5556, "youden_j": -0.1156, "cvss_coverage": 1.0, "cvss_tp_weight": 72.8, "cvss_fp_weight": 2.5, "cvss_fn_weight": 72.8, "cvss_precision": 0.9668, "cvss_recall": 0.5, "cvss_f3": 0.5254, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.68, "f1": 0.7083, "f2": 0.6911, "f2_score": 69.1, "f3": 0.6855, "f3_score": 68.5, "tpr": 0.68, "fpr": 0.6, "youden_j": 0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 30.4, "cvss_fn_weight": 38.6, "cvss_precision": 0.7786, "cvss_recall": 0.7349, "cvss_f3": 0.739, "cvss_f3_score": 73.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 0, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.44, "f1": 0.6104, "f2": 0.4952, "f2_score": 49.5, "f3": 0.466, "f3_score": 46.6, "tpr": 0.44, "fpr": 0.0, "youden_j": 0.44, "cvss_coverage": 1.0, "cvss_tp_weight": 69.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 75.8, "cvss_precision": 1.0, "cvss_recall": 0.4796, "cvss_f3": 0.5058, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 0, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.32, "f1": 0.4848, "f2": 0.3704, "f2_score": 37.0, "f3": 0.3433, "f3_score": 34.3, "tpr": 0.32, "fpr": 0.0, "youden_j": 0.32, "cvss_coverage": 1.0, "cvss_tp_weight": 56.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 88.8, "cvss_precision": 1.0, "cvss_recall": 0.3901, "cvss_f3": 0.4154, "cvss_f3_score": 41.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 6, "recall": 0.4 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 8, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.72, "f1": 0.7059, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7171, "f3_score": 71.7, "tpr": 0.72, "fpr": 0.6667, "youden_j": 0.0533, "cvss_coverage": 1.0, "cvss_tp_weight": 113.5, "cvss_fp_weight": 31.4, "cvss_fn_weight": 32.1, "cvss_precision": 0.7831, "cvss_recall": 0.7795, "cvss_f3": 0.7799, "cvss_f3_score": 78.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 7, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7004, "recall": 0.68, "f1": 0.6896, "f2": 0.6837, "f2_score": 68.4, "f3": 0.6818, "f3_score": 68.2, "tpr": 0.68, "fpr": 0.6429, "youden_j": 0.0371, "cvss_coverage": 1.0, "cvss_tp_weight": 110.4, "cvss_fp_weight": 20.1, "cvss_fn_weight": 35.2, "cvss_precision": 0.8532, "cvss_recall": 0.7582, "cvss_f3": 0.7662, "cvss_f3_score": 76.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 1, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9333, "recall": 0.56, "f1": 0.7, "f2": 0.6087, "f2_score": 60.9, "f3": 0.5833, "f3_score": 58.3, "tpr": 0.56, "fpr": 0.2, "youden_j": 0.36, "cvss_coverage": 1.0, "cvss_tp_weight": 93.7, "cvss_fp_weight": 6.0, "cvss_fn_weight": 51.9, "cvss_precision": 0.9399, "cvss_recall": 0.6435, "cvss_f3": 0.6645, "cvss_f3_score": 66.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 1, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9615, "recall": 1.0, "f1": 0.9804, "f2": 0.9921, "f2_score": 99.2, "f3": 0.996, "f3_score": 99.6, "tpr": 1.0, "fpr": 0.2, "youden_j": 0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 145.6, "cvss_fp_weight": 6.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.9605, "cvss_recall": 1.0, "cvss_f3": 0.9959, "cvss_f3_score": 99.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-083", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-560", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-640", "file": "backend/app/seller_operations.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 3, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.6, "f1": 0.6977, "f2": 0.6356, "f2_score": 63.6, "f3": 0.6173, "f3_score": 61.7, "tpr": 0.6, "fpr": 0.4286, "youden_j": 0.1714, "cvss_coverage": 1.0, "cvss_tp_weight": 98.7, "cvss_fp_weight": 7.0, "cvss_fn_weight": 46.9, "cvss_precision": 0.9339, "cvss_recall": 0.6779, "cvss_f3": 0.697, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 9, "fp": 13, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4091, "recall": 0.36, "f1": 0.383, "f2": 0.3689, "f2_score": 36.9, "f3": 0.3644, "f3_score": 36.4, "tpr": 0.36, "fpr": 0.7647, "youden_j": -0.4047, "cvss_coverage": 1.0, "cvss_tp_weight": 61.8, "cvss_fp_weight": 61.4, "cvss_fn_weight": 83.8, "cvss_precision": 0.5018, "cvss_recall": 0.4245, "cvss_f3": 0.4311, "cvss_f3_score": 43.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 25, "fp": 8, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7576, "recall": 1.0, "f1": 0.8621, "f2": 0.9398, "f2_score": 94.0, "f3": 0.969, "f3_score": 96.9, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 145.6, "cvss_fp_weight": 42.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.7745, "cvss_recall": 1.0, "cvss_f3": 0.9717, "cvss_f3_score": 97.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-083", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-560", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-640", "file": "backend/app/seller_operations.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6931, "recall": 0.4933, "f1": 0.5752, "f2": 0.5229, "f2_score": 52.3, "f3": 0.5077, "f3_score": 50.8, "tpr": 0.4933, "fpr": 0.5651, "youden_j": -0.0718, "cvss_coverage": 1.0, "cvss_tp_weight": 78.9, "cvss_fp_weight": 28.4, "cvss_fn_weight": 66.7, "cvss_precision": 0.737, "cvss_recall": 0.5417, "cvss_f3": 0.5564, "cvss_f3_score": 55.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 4, "fp": 0, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.16, "f1": 0.2759, "f2": 0.1923, "f2_score": 19.2, "f3": 0.1747, "f3_score": 17.5, "tpr": 0.16, "fpr": 0.0, "youden_j": 0.16, "cvss_coverage": 1.0, "cvss_tp_weight": 22.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 123.2, "cvss_precision": 1.0, "cvss_recall": 0.1538, "cvss_f3": 0.1681, "cvss_f3_score": 16.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6903, "recall": 0.5333, "f1": 0.6017, "f2": 0.5587, "f2_score": 55.9, "f3": 0.5457, "f3_score": 54.6, "tpr": 0.5333, "fpr": 0.5973, "youden_j": -0.064, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 10.3, "cvss_fn_weight": 58.0, "cvss_precision": 0.8987, "cvss_recall": 0.6014, "cvss_f3": 0.6218, "cvss_f3_score": 62.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 4, "recall": 0.6 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-560", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 5, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.68, "f1": 0.7234, "f2": 0.6967, "f2_score": 69.7, "f3": 0.6883, "f3_score": 68.8, "tpr": 0.68, "fpr": 0.5556, "youden_j": 0.1244, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 13.5, "cvss_fn_weight": 38.6, "cvss_precision": 0.8882, "cvss_recall": 0.7349, "cvss_f3": 0.7478, "cvss_f3_score": 74.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 13, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.52, "f1": 0.65, "f2": 0.5652, "f2_score": 56.5, "f3": 0.5417, "f3_score": 54.2, "tpr": 0.52, "fpr": 0.3333, "youden_j": 0.1867, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 15.0, "cvss_fn_weight": 57.2, "cvss_precision": 0.8549, "cvss_recall": 0.6071, "cvss_f3": 0.6253, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 3, "recall": 0.7 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 22, "fp": 48, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3143, "recall": 0.88, "f1": 0.4632, "f2": 0.6471, "f2_score": 64.7, "f3": 0.7458, "f3_score": 74.6, "tpr": 0.88, "fpr": 0.9231, "youden_j": -0.0431, "cvss_coverage": 1.0, "cvss_tp_weight": 130.5, "cvss_fp_weight": 326.5, "cvss_fn_weight": 15.1, "cvss_precision": 0.2856, "cvss_recall": 0.8963, "cvss_f3": 0.7384, "cvss_f3_score": 73.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 22, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4762, "recall": 0.8, "f1": 0.597, "f2": 0.7042, "f2_score": 70.4, "f3": 0.7491, "f3_score": 74.9, "tpr": 0.8, "fpr": 0.8462, "youden_j": -0.0462, "cvss_coverage": 1.0, "cvss_tp_weight": 118.2, "cvss_fp_weight": 141.0, "cvss_fn_weight": 27.4, "cvss_precision": 0.456, "cvss_recall": 0.8118, "cvss_f3": 0.7531, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 2, "recall": 0.8 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.04, "f1": 0.0769, "f2": 0.0495, "f2_score": 5.0, "f3": 0.0442, "f3_score": 4.4, "tpr": 0.04, "fpr": 0.0, "youden_j": 0.04, "cvss_coverage": 1.0, "cvss_tp_weight": 9.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 135.8, "cvss_precision": 1.0, "cvss_recall": 0.0673, "cvss_f3": 0.0742, "cvss_f3_score": 7.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 9, "recall": 0.1 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 18, "fp": 50, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2647, "recall": 0.72, "f1": 0.3871, "f2": 0.5357, "f2_score": 53.6, "f3": 0.6143, "f3_score": 61.4, "tpr": 0.72, "fpr": 0.9259, "youden_j": -0.2059, "cvss_coverage": 1.0, "cvss_tp_weight": 110.9, "cvss_fp_weight": 344.0, "cvss_fn_weight": 34.7, "cvss_precision": 0.2438, "cvss_recall": 0.7617, "cvss_f3": 0.6282, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-083", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 23, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5208, "recall": 1.0, "f1": 0.6849, "f2": 0.8446, "f2_score": 84.5, "f3": 0.9158, "f3_score": 91.6, "tpr": 1.0, "fpr": 0.8519, "youden_j": 0.1481, "cvss_coverage": 1.0, "cvss_tp_weight": 145.6, "cvss_fp_weight": 179.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.4486, "cvss_recall": 1.0, "cvss_f3": 0.8905, "cvss_f3_score": 89.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-083", "file": "backend/app/seller_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-560", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-640", "file": "backend/app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 19, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4722, "recall": 0.68, "f1": 0.5574, "f2": 0.625, "f2_score": 62.5, "f3": 0.6513, "f3_score": 65.1, "tpr": 0.68, "fpr": 0.8261, "youden_j": -0.1461, "cvss_coverage": 1.0, "cvss_tp_weight": 109.8, "cvss_fp_weight": 124.0, "cvss_fn_weight": 35.8, "cvss_precision": 0.4696, "cvss_recall": 0.7541, "cvss_f3": 0.711, "cvss_f3_score": 71.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 18, "fp": 70, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2045, "recall": 0.72, "f1": 0.3186, "f2": 0.4787, "f2_score": 47.9, "f3": 0.5751, "f3_score": 57.5, "tpr": 0.72, "fpr": 0.9459, "youden_j": -0.2259, "cvss_coverage": 1.0, "cvss_tp_weight": 110.9, "cvss_fp_weight": 457.5, "cvss_fn_weight": 34.7, "cvss_precision": 0.1951, "cvss_recall": 0.7617, "cvss_f3": 0.5903, "cvss_f3_score": 59.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 1, "recall": 0.9 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/jobs.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-083", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-084", "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-200", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-313", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7583, "recall": 0.3733, "f1": 0.4962, "f2": 0.414, "f2_score": 41.4, "f3": 0.3925, "f3_score": 39.3, "tpr": 0.3733, "fpr": 0.4095, "youden_j": -0.0362, "cvss_coverage": 1.0, "cvss_tp_weight": 62.7, "cvss_fp_weight": 14.5, "cvss_fn_weight": 82.9, "cvss_precision": 0.8205, "cvss_recall": 0.4309, "cvss_f3": 0.4521, "cvss_f3_score": 45.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 5, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-082", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-597", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-570", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 9, "fp": 16, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 0.36, "f1": 0.36, "f2": 0.36, "f2_score": 36.0, "f3": 0.36, "f3_score": 36.0, "tpr": 0.36, "fpr": 0.8, "youden_j": -0.44, "cvss_coverage": 1.0, "cvss_tp_weight": 50.4, "cvss_fp_weight": 79.3, "cvss_fn_weight": 95.2, "cvss_precision": 0.3885, "cvss_recall": 0.3462, "cvss_f3": 0.35, "cvss_f3_score": 35.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-610", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-225", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 14, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7778, "youden_j": -0.7778, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 83.8, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "seller_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "rowan": { "scanner": "rowan", "tp": 10, "fp": 17, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3704, "recall": 0.4, "f1": 0.3846, "f2": 0.3937, "f2_score": 39.4, "f3": 0.3968, "f3_score": 39.7, "tpr": 0.4, "fpr": 0.85, "youden_j": -0.45, "cvss_coverage": 1.0, "cvss_tp_weight": 55.9, "cvss_fp_weight": 93.0, "cvss_fn_weight": 89.7, "cvss_precision": 0.3754, "cvss_recall": 0.3839, "cvss_f3": 0.3831, "cvss_f3_score": 38.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 1, "fn": 8, "recall": 0.2 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-580", "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-328", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-620", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/jobs.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_security_workflows.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 2, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.3333, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 6.5, "cvss_fn_weight": 145.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 10, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-marketplace-commerce-fastapi/backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-158", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-279", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-600", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-630", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.24, "f1": 0.3077, "f2": 0.2632, "f2_score": 26.3, "f3": 0.251, "f3_score": 25.1, "tpr": 0.24, "fpr": 0.6667, "youden_j": -0.4267, "cvss_coverage": 1.0, "cvss_tp_weight": 34.8, "cvss_fp_weight": 58.4, "cvss_fn_weight": 110.8, "cvss_precision": 0.3733, "cvss_recall": 0.239, "cvss_f3": 0.2479, "cvss_f3_score": 24.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 8, "recall": 0.2 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-158", "file": "backend/app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-279", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-600", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-630", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_security_workflows.py", "cwe": "CWE-377" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_flows.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-082", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-083", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-084", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-200", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-225", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-313", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-328", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-560", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-570", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-580", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-597", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-610", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-620", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-640", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] } }, "vc-codex-high-seeded-v2-property-management-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 9, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.8077, "f1": 0.75, "f2": 0.7836, "f2_score": 78.4, "f3": 0.7955, "f3_score": 79.5, "tpr": 0.8077, "fpr": 0.6923, "youden_j": 0.1154, "cvss_coverage": 1.0, "cvss_tp_weight": 124.8, "cvss_fp_weight": 50.0, "cvss_fn_weight": 17.6, "cvss_precision": 0.714, "cvss_recall": 0.8764, "cvss_f3": 0.8569, "cvss_f3_score": 85.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-085", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-641", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/users.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 5, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.6154, "f1": 0.6809, "f2": 0.64, "f2_score": 64.0, "f3": 0.6275, "f3_score": 62.7, "tpr": 0.6154, "fpr": 0.5556, "youden_j": 0.0598, "cvss_coverage": 1.0, "cvss_tp_weight": 96.9, "cvss_fp_weight": 17.7, "cvss_fn_weight": 45.5, "cvss_precision": 0.8458, "cvss_recall": 0.6805, "cvss_f3": 0.694, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.6154, "f1": 0.6667, "f2": 0.6349, "f2_score": 63.5, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6154, "fpr": 0.6, "youden_j": 0.0154, "cvss_coverage": 1.0, "cvss_tp_weight": 99.5, "cvss_fp_weight": 33.3, "cvss_fn_weight": 42.9, "cvss_precision": 0.7491, "cvss_recall": 0.6987, "cvss_f3": 0.7035, "cvss_f3_score": 70.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 1, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 0.5, "f1": 0.65, "f2": 0.5508, "f2_score": 55.1, "f3": 0.5242, "f3_score": 52.4, "tpr": 0.5, "fpr": 0.2, "youden_j": 0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 83.4, "cvss_fp_weight": 0.5, "cvss_fn_weight": 59.0, "cvss_precision": 0.994, "cvss_recall": 0.5857, "cvss_f3": 0.6108, "cvss_f3_score": 61.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 9, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6538, "recall": 0.6538, "f1": 0.6538, "f2": 0.6538, "f2_score": 65.4, "f3": 0.6538, "f3_score": 65.4, "tpr": 0.6538, "fpr": 0.6923, "youden_j": -0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 39.9, "cvss_fn_weight": 36.4, "cvss_precision": 0.7267, "cvss_recall": 0.7444, "cvss_f3": 0.7426, "cvss_f3_score": 74.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 1, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8964, "recall": 0.4359, "f1": 0.5853, "f2": 0.4854, "f2_score": 48.5, "f3": 0.4593, "f3_score": 45.9, "tpr": 0.4359, "fpr": 0.2444, "youden_j": 0.1914, "cvss_coverage": 1.0, "cvss_tp_weight": 69.2, "cvss_fp_weight": 5.8, "cvss_fn_weight": 73.2, "cvss_precision": 0.9235, "cvss_recall": 0.4857, "cvss_f3": 0.5098, "cvss_f3_score": 51.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.3846, "f1": 0.5263, "f2": 0.431, "f2_score": 43.1, "f3": 0.4065, "f3_score": 40.7, "tpr": 0.3846, "fpr": 0.3333, "youden_j": 0.0513, "cvss_coverage": 1.0, "cvss_tp_weight": 67.5, "cvss_fp_weight": 6.1, "cvss_fn_weight": 74.9, "cvss_precision": 0.9177, "cvss_recall": 0.474, "cvss_f3": 0.4981, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 20, "fp": 18, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5263, "recall": 0.7692, "f1": 0.625, "f2": 0.7042, "f2_score": 70.4, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.7692, "fpr": 0.8182, "youden_j": -0.049, "cvss_coverage": 1.0, "cvss_tp_weight": 120.5, "cvss_fp_weight": 54.5, "cvss_fn_weight": 21.9, "cvss_precision": 0.6887, "cvss_recall": 0.8462, "cvss_f3": 0.8273, "cvss_f3_score": 82.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-085", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 6, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6911, "recall": 0.5513, "f1": 0.6123, "f2": 0.574, "f2_score": 57.4, "f3": 0.5624, "f3_score": 56.2, "tpr": 0.5513, "fpr": 0.6121, "youden_j": -0.0609, "cvss_coverage": 1.0, "cvss_tp_weight": 95.1, "cvss_fp_weight": 18.3, "cvss_fn_weight": 47.3, "cvss_precision": 0.8373, "cvss_recall": 0.6676, "cvss_f3": 0.6814, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 3, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.6154, "f1": 0.7111, "f2": 0.6504, "f2_score": 65.0, "f3": 0.6324, "f3_score": 63.2, "tpr": 0.6154, "fpr": 0.4286, "youden_j": 0.1868, "cvss_coverage": 1.0, "cvss_tp_weight": 99.5, "cvss_fp_weight": 11.6, "cvss_fn_weight": 42.9, "cvss_precision": 0.8955, "cvss_recall": 0.6987, "cvss_f3": 0.7144, "cvss_f3_score": 71.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 17, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5405, "recall": 0.7692, "f1": 0.6349, "f2": 0.7092, "f2_score": 70.9, "f3": 0.738, "f3_score": 73.8, "tpr": 0.7692, "fpr": 0.8095, "youden_j": -0.0403, "cvss_coverage": 1.0, "cvss_tp_weight": 118.3, "cvss_fp_weight": 84.3, "cvss_fn_weight": 24.1, "cvss_precision": 0.5839, "cvss_recall": 0.8308, "cvss_f3": 0.7971, "cvss_f3_score": 79.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-085", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-561", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5769, "f1": 0.6522, "f2": 0.6048, "f2_score": 60.5, "f3": 0.5906, "f3_score": 59.1, "tpr": 0.5769, "fpr": 0.5556, "youden_j": 0.0214, "cvss_coverage": 1.0, "cvss_tp_weight": 97.6, "cvss_fp_weight": 22.7, "cvss_fn_weight": 44.8, "cvss_precision": 0.8112, "cvss_recall": 0.6854, "cvss_f3": 0.6962, "cvss_f3_score": 69.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-085", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 13, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.4615, "f1": 0.4706, "f2": 0.4651, "f2_score": 46.5, "f3": 0.4633, "f3_score": 46.3, "tpr": 0.4615, "fpr": 0.7647, "youden_j": -0.3032, "cvss_coverage": 1.0, "cvss_tp_weight": 80.3, "cvss_fp_weight": 72.2, "cvss_fn_weight": 62.1, "cvss_precision": 0.5266, "cvss_recall": 0.5639, "cvss_f3": 0.5599, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 26, "fp": 8, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 1.0, "f1": 0.8667, "f2": 0.942, "f2_score": 94.2, "f3": 0.9701, "f3_score": 97.0, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 142.4, "cvss_fp_weight": 44.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.7622, "cvss_recall": 1.0, "cvss_f3": 0.9697, "cvss_f3_score": 97.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-085", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-561", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-641", "file": "backend/app/tenant_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-863" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7431, "recall": 0.5128, "f1": 0.606, "f2": 0.5463, "f2_score": 54.7, "f3": 0.529, "f3_score": 52.9, "tpr": 0.5128, "fpr": 0.5281, "youden_j": -0.0152, "cvss_coverage": 1.0, "cvss_tp_weight": 80.5, "cvss_fp_weight": 14.2, "cvss_fn_weight": 61.9, "cvss_precision": 0.8521, "cvss_recall": 0.5653, "cvss_f3": 0.5849, "cvss_f3_score": 58.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7181, "recall": 0.4615, "f1": 0.5589, "f2": 0.4957, "f2_score": 49.6, "f3": 0.478, "f3_score": 47.8, "tpr": 0.4615, "fpr": 0.5232, "youden_j": -0.0617, "cvss_coverage": 1.0, "cvss_tp_weight": 79.0, "cvss_fp_weight": 12.6, "cvss_fn_weight": 63.4, "cvss_precision": 0.8656, "cvss_recall": 0.555, "cvss_f3": 0.5753, "cvss_f3_score": 57.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 6, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7224, "recall": 0.5641, "f1": 0.631, "f2": 0.5887, "f2_score": 58.9, "f3": 0.5761, "f3_score": 57.6, "tpr": 0.5641, "fpr": 0.5825, "youden_j": -0.0184, "cvss_coverage": 1.0, "cvss_tp_weight": 95.4, "cvss_fp_weight": 16.3, "cvss_fn_weight": 47.0, "cvss_precision": 0.8571, "cvss_recall": 0.6697, "cvss_f3": 0.684, "cvss_f3_score": 68.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 14, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.6154, "f1": 0.5714, "f2": 0.597, "f2_score": 59.7, "f3": 0.6061, "f3_score": 60.6, "tpr": 0.6154, "fpr": 0.7778, "youden_j": -0.1624, "cvss_coverage": 1.0, "cvss_tp_weight": 99.5, "cvss_fp_weight": 47.4, "cvss_fn_weight": 42.9, "cvss_precision": 0.6772, "cvss_recall": 0.6987, "cvss_f3": 0.6965, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 11, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7333, "recall": 0.4231, "f1": 0.5366, "f2": 0.4622, "f2_score": 46.2, "f3": 0.4418, "f3_score": 44.2, "tpr": 0.4231, "fpr": 0.5, "youden_j": -0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 23.5, "cvss_fn_weight": 62.8, "cvss_precision": 0.7721, "cvss_recall": 0.559, "cvss_f3": 0.5749, "cvss_f3_score": 57.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 20, "fp": 57, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2597, "recall": 0.7692, "f1": 0.3883, "f2": 0.5525, "f2_score": 55.2, "f3": 0.6431, "f3_score": 64.3, "tpr": 0.7692, "fpr": 0.9344, "youden_j": -0.1652, "cvss_coverage": 1.0, "cvss_tp_weight": 117.7, "cvss_fp_weight": 381.5, "cvss_fn_weight": 24.7, "cvss_precision": 0.2358, "cvss_recall": 0.8265, "cvss_f3": 0.6609, "cvss_f3_score": 66.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-799" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 27, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4255, "recall": 0.7692, "f1": 0.5479, "f2": 0.6623, "f2_score": 66.2, "f3": 0.7117, "f3_score": 71.2, "tpr": 0.7692, "fpr": 0.871, "youden_j": -0.1017, "cvss_coverage": 1.0, "cvss_tp_weight": 117.1, "cvss_fp_weight": 177.0, "cvss_fn_weight": 25.3, "cvss_precision": 0.3982, "cvss_recall": 0.8223, "cvss_f3": 0.7432, "cvss_f3_score": 74.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/inspections.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 2, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0769, "f1": 0.1333, "f2": 0.0926, "f2_score": 9.3, "f3": 0.084, "f3_score": 8.4, "tpr": 0.0769, "fpr": 0.3333, "youden_j": -0.2564, "cvss_coverage": 1.0, "cvss_tp_weight": 13.0, "cvss_fp_weight": 13.5, "cvss_fn_weight": 129.4, "cvss_precision": 0.4906, "cvss_recall": 0.0913, "cvss_f3": 0.0994, "cvss_f3_score": 9.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routes/users.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 67, "fn": 5, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2386, "recall": 0.8077, "f1": 0.3684, "f2": 0.5469, "f2_score": 54.7, "f3": 0.6522, "f3_score": 65.2, "tpr": 0.8077, "fpr": 0.971, "youden_j": -0.1633, "cvss_coverage": 1.0, "cvss_tp_weight": 120.8, "cvss_fp_weight": 434.0, "cvss_fn_weight": 21.6, "cvss_precision": 0.2177, "cvss_recall": 0.8483, "cvss_f3": 0.6578, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 2, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": "backend/app/routes/properties.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 8, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.9231, "f1": 0.8276, "f2": 0.8824, "f2_score": 88.2, "f3": 0.9023, "f3_score": 90.2, "tpr": 0.9231, "fpr": 0.6667, "youden_j": 0.2564, "cvss_coverage": 1.0, "cvss_tp_weight": 131.6, "cvss_fp_weight": 64.0, "cvss_fn_weight": 10.8, "cvss_precision": 0.6728, "cvss_recall": 0.9242, "cvss_f3": 0.8909, "cvss_f3_score": 89.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-561", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-641", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 4, "fp": 8, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.1538, "f1": 0.2105, "f2": 0.1724, "f2_score": 17.2, "f3": 0.1626, "f3_score": 16.3, "tpr": 0.1538, "fpr": 0.6667, "youden_j": -0.5128, "cvss_coverage": 1.0, "cvss_tp_weight": 23.9, "cvss_fp_weight": 50.5, "cvss_fn_weight": 118.5, "cvss_precision": 0.3212, "cvss_recall": 0.1678, "cvss_f3": 0.1763, "cvss_f3_score": 17.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 99, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.1818, "recall": 0.8462, "f1": 0.2993, "f2": 0.4889, "f2_score": 48.9, "f3": 0.6197, "f3_score": 62.0, "tpr": 0.8462, "fpr": 0.9802, "youden_j": -0.134, "cvss_coverage": 1.0, "cvss_tp_weight": 123.0, "cvss_fp_weight": 627.5, "cvss_fn_weight": 19.4, "cvss_precision": 0.1639, "cvss_recall": 0.8638, "cvss_f3": 0.6053, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 2, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/routes/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/documents.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/integrations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/messages.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": "backend/app/routes/properties.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/tickets.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routes/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/users.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/serializers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-201", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-314", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-571", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 11, "fp": 6, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6964, "recall": 0.4231, "f1": 0.5154, "f2": 0.4542, "f2_score": 45.4, "f3": 0.4379, "f3_score": 43.8, "tpr": 0.4231, "fpr": 0.5821, "youden_j": -0.159, "cvss_coverage": 1.0, "cvss_tp_weight": 71.1, "cvss_fp_weight": 28.1, "cvss_fn_weight": 71.3, "cvss_precision": 0.747, "cvss_recall": 0.4995, "cvss_f3": 0.5145, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 1, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-086", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-590", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-611", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-242", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 11, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4211, "recall": 0.3077, "f1": 0.3556, "f2": 0.3252, "f2_score": 32.5, "f3": 0.3162, "f3_score": 31.6, "tpr": 0.3077, "fpr": 0.7857, "youden_j": -0.478, "cvss_coverage": 1.0, "cvss_tp_weight": 51.3, "cvss_fp_weight": 50.0, "cvss_fn_weight": 91.1, "cvss_precision": 0.5064, "cvss_recall": 0.3603, "cvss_f3": 0.371, "cvss_f3_score": 37.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 1, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-581", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routes/auth.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routes/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-621", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routes/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_security_workflows.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/files.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/files.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 5, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.5556, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 22.7, "cvss_fn_weight": 142.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-property-management-fastapi/backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-087", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-159", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-280", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-357", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-601", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-631", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 8, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.2692, "f1": 0.3415, "f2": 0.2941, "f2_score": 29.4, "f3": 0.2811, "f3_score": 28.1, "tpr": 0.2692, "fpr": 0.6667, "youden_j": -0.3974, "cvss_coverage": 1.0, "cvss_tp_weight": 38.9, "cvss_fp_weight": 52.3, "cvss_fn_weight": 103.5, "cvss_precision": 0.4264, "cvss_recall": 0.2732, "cvss_f3": 0.2834, "cvss_f3_score": 28.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-087", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-159", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-280", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-357", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-601", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-631", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-085", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-086", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-201", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-242", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-314", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-561", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-571", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-581", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-590", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-611", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-621", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-641", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" } ] } }, "vc-codex-high-seeded-v2-support-desk-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.7143, "f1": 0.7407, "f2": 0.7246, "f2_score": 72.5, "f3": 0.7194, "f3_score": 71.9, "tpr": 0.7143, "fpr": 0.6, "youden_j": 0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 112.4, "cvss_fp_weight": 29.8, "cvss_fn_weight": 44.6, "cvss_precision": 0.7906, "cvss_recall": 0.7159, "cvss_f3": 0.7228, "cvss_f3_score": 72.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 11, "fp": 0, "fn": 7, "recall": 0.6111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-642", "file": "app/support_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6522, "recall": 0.5357, "f1": 0.5882, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5455, "f3_score": 54.5, "tpr": 0.5357, "fpr": 0.6667, "youden_j": -0.131, "cvss_coverage": 1.0, "cvss_tp_weight": 86.7, "cvss_fp_weight": 41.5, "cvss_fn_weight": 70.3, "cvss_precision": 0.6764, "cvss_recall": 0.5522, "cvss_f3": 0.5626, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5714, "f1": 0.6957, "f2": 0.6154, "f2_score": 61.5, "f3": 0.5926, "f3_score": 59.3, "tpr": 0.5714, "fpr": 0.3333, "youden_j": 0.2381, "cvss_coverage": 1.0, "cvss_tp_weight": 93.6, "cvss_fp_weight": 11.7, "cvss_fn_weight": 63.4, "cvss_precision": 0.8888, "cvss_recall": 0.5962, "cvss_f3": 0.6165, "cvss_f3_score": 61.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.5, "f1": 0.5957, "f2": 0.5344, "f2_score": 53.4, "f3": 0.5166, "f3_score": 51.7, "tpr": 0.5, "fpr": 0.5556, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 84.7, "cvss_fp_weight": 7.9, "cvss_fn_weight": 72.3, "cvss_precision": 0.9152, "cvss_recall": 0.5395, "cvss_f3": 0.5626, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.5357, "f1": 0.6122, "f2": 0.5639, "f2_score": 56.4, "f3": 0.5495, "f3_score": 54.9, "tpr": 0.5357, "fpr": 0.6, "youden_j": -0.0643, "cvss_coverage": 1.0, "cvss_tp_weight": 83.4, "cvss_fp_weight": 29.8, "cvss_fn_weight": 73.6, "cvss_precision": 0.737, "cvss_recall": 0.5312, "cvss_f3": 0.5465, "cvss_f3_score": 54.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9116, "recall": 0.369, "f1": 0.5252, "f2": 0.4188, "f2_score": 41.9, "f3": 0.3924, "f3_score": 39.2, "tpr": 0.369, "fpr": 0.2, "youden_j": 0.169, "cvss_coverage": 1.0, "cvss_tp_weight": 59.3, "cvss_fp_weight": 5.9, "cvss_fn_weight": 97.7, "cvss_precision": 0.9097, "cvss_recall": 0.378, "cvss_f3": 0.4013, "cvss_f3_score": 40.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 157.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-160", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-325", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-582", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-632", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8693, "recall": 0.4643, "f1": 0.6049, "f2": 0.5118, "f2_score": 51.2, "f3": 0.4869, "f3_score": 48.7, "tpr": 0.4643, "fpr": 0.3206, "youden_j": 0.1437, "cvss_coverage": 1.0, "cvss_tp_weight": 74.8, "cvss_fp_weight": 6.4, "cvss_fn_weight": 82.2, "cvss_precision": 0.9254, "cvss_recall": 0.4764, "cvss_f3": 0.5006, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.742, "recall": 0.5238, "f1": 0.6131, "f2": 0.556, "f2_score": 55.6, "f3": 0.5394, "f3_score": 53.9, "tpr": 0.5238, "fpr": 0.5402, "youden_j": -0.0163, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 18.6, "cvss_fn_weight": 70.4, "cvss_precision": 0.8208, "cvss_recall": 0.5518, "cvss_f3": 0.5704, "cvss_f3_score": 57.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 18, "fp": 13, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6002, "recall": 0.631, "f1": 0.6082, "f2": 0.6198, "f2_score": 62.0, "f3": 0.625, "f3_score": 62.5, "tpr": 0.631, "fpr": 0.73, "youden_j": -0.099, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 52.9, "cvss_fn_weight": 51.0, "cvss_precision": 0.6948, "cvss_recall": 0.675, "cvss_f3": 0.6742, "cvss_f3_score": 67.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-87" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-87" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 4, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.6429, "f1": 0.72, "f2": 0.6716, "f2_score": 67.2, "f3": 0.6569, "f3_score": 65.7, "tpr": 0.6429, "fpr": 0.5, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 107.2, "cvss_fp_weight": 18.1, "cvss_fn_weight": 49.8, "cvss_precision": 0.8558, "cvss_recall": 0.6828, "cvss_f3": 0.6969, "cvss_f3_score": 69.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 6, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7259, "recall": 0.5952, "f1": 0.6533, "f2": 0.617, "f2_score": 61.7, "f3": 0.6059, "f3_score": 60.6, "tpr": 0.5952, "fpr": 0.6095, "youden_j": -0.0142, "cvss_coverage": 1.0, "cvss_tp_weight": 100.4, "cvss_fp_weight": 24.6, "cvss_fn_weight": 56.6, "cvss_precision": 0.8031, "cvss_recall": 0.6395, "cvss_f3": 0.6527, "cvss_f3_score": 65.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.4286, "f1": 0.5714, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4511, "f3_score": 45.1, "tpr": 0.4286, "fpr": 0.3333, "youden_j": 0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 72.8, "cvss_fp_weight": 6.4, "cvss_fn_weight": 84.2, "cvss_precision": 0.9197, "cvss_recall": 0.4637, "cvss_f3": 0.4879, "cvss_f3_score": 48.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 28, "fp": 7, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 1.0, "f1": 0.8889, "f2": 0.9524, "f2_score": 95.2, "f3": 0.9756, "f3_score": 97.6, "tpr": 1.0, "fpr": 0.6364, "youden_j": 0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 157.0, "cvss_fp_weight": 41.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.793, "cvss_recall": 1.0, "cvss_f3": 0.9746, "cvss_f3_score": 97.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/routers/admin.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-642", "file": "app/support_operations.py", "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4286, "f1": 0.5455, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4478, "f3_score": 44.8, "tpr": 0.4286, "fpr": 0.5, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 79.1, "cvss_fp_weight": 18.1, "cvss_fn_weight": 77.9, "cvss_precision": 0.8141, "cvss_recall": 0.5038, "cvss_f3": 0.5238, "cvss_f3_score": 52.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 10, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.4286, "f1": 0.48, "f2": 0.4478, "f2_score": 44.8, "f3": 0.438, "f3_score": 43.8, "tpr": 0.4286, "fpr": 0.7143, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 76.3, "cvss_fp_weight": 53.2, "cvss_fn_weight": 80.7, "cvss_precision": 0.5893, "cvss_recall": 0.486, "cvss_f3": 0.4947, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/deps.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 15, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5946, "recall": 0.7857, "f1": 0.6769, "f2": 0.7383, "f2_score": 73.8, "f3": 0.7612, "f3_score": 76.1, "tpr": 0.7857, "fpr": 0.7895, "youden_j": -0.0038, "cvss_coverage": 1.0, "cvss_tp_weight": 125.3, "cvss_fp_weight": 50.3, "cvss_fn_weight": 31.7, "cvss_precision": 0.7135, "cvss_recall": 0.7981, "cvss_f3": 0.7887, "cvss_f3_score": 78.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7222 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8145, "recall": 0.4524, "f1": 0.5794, "f2": 0.4956, "f2_score": 49.6, "f3": 0.473, "f3_score": 47.3, "tpr": 0.4524, "fpr": 0.4074, "youden_j": 0.045, "cvss_coverage": 1.0, "cvss_tp_weight": 71.5, "cvss_fp_weight": 14.0, "cvss_fn_weight": 85.5, "cvss_precision": 0.8435, "cvss_recall": 0.4552, "cvss_f3": 0.4766, "cvss_f3_score": 47.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5357, "f1": 0.625, "f2": 0.5682, "f2_score": 56.8, "f3": 0.5515, "f3_score": 55.1, "tpr": 0.5357, "fpr": 0.5556, "youden_j": -0.0198, "cvss_coverage": 1.0, "cvss_tp_weight": 90.5, "cvss_fp_weight": 13.2, "cvss_fn_weight": 66.5, "cvss_precision": 0.8727, "cvss_recall": 0.5764, "cvss_f3": 0.5967, "cvss_f3_score": 59.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 7, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6848, "recall": 0.5357, "f1": 0.5998, "f2": 0.5594, "f2_score": 55.9, "f3": 0.5473, "f3_score": 54.7, "tpr": 0.5357, "fpr": 0.6308, "youden_j": -0.0951, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 14.2, "cvss_fn_weight": 65.5, "cvss_precision": 0.8656, "cvss_recall": 0.5828, "cvss_f3": 0.6024, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 4, "recall": 0.5 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.5714, "f1": 0.6531, "f2": 0.6015, "f2_score": 60.2, "f3": 0.5861, "f3_score": 58.6, "tpr": 0.5714, "fpr": 0.5556, "youden_j": 0.0159, "cvss_coverage": 1.0, "cvss_tp_weight": 94.2, "cvss_fp_weight": 18.6, "cvss_fn_weight": 62.8, "cvss_precision": 0.8354, "cvss_recall": 0.6, "cvss_f3": 0.6174, "cvss_f3_score": 61.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 2, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 9, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.5714, "f1": 0.6038, "f2": 0.5839, "f2_score": 58.4, "f3": 0.5776, "f3_score": 57.8, "tpr": 0.5714, "fpr": 0.75, "youden_j": -0.1786, "cvss_coverage": 1.0, "cvss_tp_weight": 92.8, "cvss_fp_weight": 58.0, "cvss_fn_weight": 64.2, "cvss_precision": 0.6154, "cvss_recall": 0.5911, "cvss_f3": 0.5934, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 9, "fp": 1, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": "app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 54, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.28, "recall": 0.75, "f1": 0.4078, "f2": 0.5615, "f2_score": 56.1, "f3": 0.6422, "f3_score": 64.2, "tpr": 0.75, "fpr": 0.931, "youden_j": -0.181, "cvss_coverage": 1.0, "cvss_tp_weight": 118.8, "cvss_fp_weight": 349.0, "cvss_fn_weight": 38.2, "cvss_precision": 0.254, "cvss_recall": 0.7567, "cvss_f3": 0.6316, "cvss_f3_score": 63.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 12, "fp": 0, "fn": 6, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/escalations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/core.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/routers/admin.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/deps.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 24, "fp": 21, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.8571, "f1": 0.6575, "f2": 0.7643, "f2_score": 76.4, "f3": 0.8081, "f3_score": 80.8, "tpr": 0.8571, "fpr": 0.84, "youden_j": 0.0171, "cvss_coverage": 1.0, "cvss_tp_weight": 136.4, "cvss_fp_weight": 141.0, "cvss_fn_weight": 20.6, "cvss_precision": 0.4917, "cvss_recall": 0.8688, "cvss_f3": 0.8069, "cvss_f3_score": 80.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 1, "recall": 0.875 }, "medium": { "tp": 15, "fp": 0, "fn": 3, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/schemas.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/core.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/routers/admin.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/reports.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 1, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.1071, "f1": 0.1875, "f2": 0.1293, "f2_score": 12.9, "f3": 0.1172, "f3_score": 11.7, "tpr": 0.1071, "fpr": 0.2, "youden_j": -0.0929, "cvss_coverage": 1.0, "cvss_tp_weight": 23.8, "cvss_fp_weight": 8.0, "cvss_fn_weight": 133.2, "cvss_precision": 0.7484, "cvss_recall": 0.1516, "cvss_f3": 0.1647, "cvss_f3_score": 16.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-160", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-325", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-582", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-632", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 26, "fp": 37, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4127, "recall": 0.9286, "f1": 0.5714, "f2": 0.7429, "f2_score": 74.3, "f3": 0.8254, "f3_score": 82.5, "tpr": 0.9286, "fpr": 0.9024, "youden_j": 0.0261, "cvss_coverage": 1.0, "cvss_tp_weight": 149.4, "cvss_fp_weight": 245.5, "cvss_fn_weight": 7.6, "cvss_precision": 0.3783, "cvss_recall": 0.9516, "cvss_f3": 0.8264, "cvss_f3_score": 82.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8889 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 2, "recall": 0.8889 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 14, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 1.0, "f1": 0.8, "f2": 0.9091, "f2_score": 90.9, "f3": 0.9524, "f3_score": 95.2, "tpr": 1.0, "fpr": 0.7778, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 157.0, "cvss_fp_weight": 109.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.5891, "cvss_recall": 1.0, "cvss_f3": 0.9348, "cvss_f3_score": 93.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": "app/routers/admin.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-642", "file": "app/support_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 18, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4857, "recall": 0.6071, "f1": 0.5397, "f2": 0.5782, "f2_score": 57.8, "f3": 0.5923, "f3_score": 59.2, "tpr": 0.6071, "fpr": 0.8182, "youden_j": -0.211, "cvss_coverage": 1.0, "cvss_tp_weight": 96.3, "cvss_fp_weight": 67.5, "cvss_fn_weight": 60.7, "cvss_precision": 0.5879, "cvss_recall": 0.6134, "cvss_f3": 0.6107, "cvss_f3_score": 61.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 3, "recall": 0.625 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 27, "fp": 77, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2596, "recall": 0.9643, "f1": 0.4091, "f2": 0.625, "f2_score": 62.5, "f3": 0.7584, "f3_score": 75.8, "tpr": 0.9643, "fpr": 0.9506, "youden_j": 0.0137, "cvss_coverage": 1.0, "cvss_tp_weight": 152.7, "cvss_fp_weight": 477.0, "cvss_fn_weight": 4.3, "cvss_precision": 0.2425, "cvss_recall": 0.9726, "cvss_f3": 0.7475, "cvss_f3_score": 74.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 1, "recall": 0.9444 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": "app/config.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/escalations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": "app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/integrations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-089", "file": "app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-622", "file": "app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6945, "recall": 0.3452, "f1": 0.4601, "f2": 0.3834, "f2_score": 38.4, "f3": 0.3633, "f3_score": 36.4, "tpr": 0.3452, "fpr": 0.5133, "youden_j": -0.168, "cvss_coverage": 1.0, "cvss_tp_weight": 60.9, "cvss_fp_weight": 21.8, "cvss_fn_weight": 96.1, "cvss_precision": 0.7367, "cvss_recall": 0.3879, "cvss_f3": 0.4068, "cvss_f3_score": 40.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 5, "recall": 0.375 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-243", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-090", "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 157.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-160", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-325", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-582", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-632", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4286, "f1": 0.5217, "f2": 0.4615, "f2_score": 46.2, "f3": 0.4444, "f3_score": 44.4, "tpr": 0.4286, "fpr": 0.6, "youden_j": -0.1714, "cvss_coverage": 1.0, "cvss_tp_weight": 63.3, "cvss_fp_weight": 24.4, "cvss_fn_weight": 93.7, "cvss_precision": 0.7217, "cvss_recall": 0.4032, "cvss_f3": 0.4218, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 6, "recall": 0.25 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-591", "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-612", "file": "app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-562", "file": "app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-572", "file": "app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-221", "file": "app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 34, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.15, "recall": 0.2143, "f1": 0.1765, "f2": 0.1974, "f2_score": 19.7, "f3": 0.2055, "f3_score": 20.5, "tpr": 0.2143, "fpr": 0.9189, "youden_j": -0.7046, "cvss_coverage": 1.0, "cvss_tp_weight": 36.5, "cvss_fp_weight": 171.5, "cvss_fn_weight": 120.5, "cvss_precision": 0.1755, "cvss_recall": 0.2325, "cvss_f3": 0.2252, "cvss_f3_score": 22.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 1, "fn": 7, "recall": 0.125 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-582", "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-325", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": "app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/kb.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": "app/routers/tickets.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/tickets.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/smoke_check.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/smoke_check.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_security_workflows.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-160", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 1, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.2, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 5.9, "cvss_fn_weight": 157.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 8, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-high-seeded-v2-support-desk-fastapi/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-088", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-160", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-281", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-325", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-582", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-602", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-632", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 6, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.2143, "f1": 0.3, "f2": 0.2419, "f2_score": 24.2, "f3": 0.2273, "f3_score": 22.7, "tpr": 0.2143, "fpr": 0.6, "youden_j": -0.3857, "cvss_coverage": 1.0, "cvss_tp_weight": 32.9, "cvss_fp_weight": 38.8, "cvss_fn_weight": 124.1, "cvss_precision": 0.4591, "cvss_recall": 0.2096, "cvss_f3": 0.2216, "cvss_f3_score": 22.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 7, "recall": 0.125 }, "medium": { "tp": 4, "fp": 0, "fn": 14, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-088", "file": "app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-160", "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-281", "file": "app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-602", "file": "app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-632", "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-089", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-090", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-221", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-243", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-325", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-562", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-572", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-582", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-591", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-612", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-622", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-642", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-312" } ] } }, "vc-codex-high-seeded-v3-crm-saas-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 11, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5217, "recall": 0.3243, "f1": 0.4, "f2": 0.3509, "f2_score": 35.1, "f3": 0.3371, "f3_score": 33.7, "tpr": 0.3243, "fpr": 1.0, "youden_j": -0.6757, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 60.5, "cvss_fn_weight": 153.0, "cvss_precision": 0.6021, "cvss_recall": 0.3742, "cvss_f3": 0.389, "cvss_f3_score": 38.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 25, "recall": 0.3243 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/data-source.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 15, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.3243, "f1": 0.375, "f2": 0.3429, "f2_score": 34.3, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.3243, "fpr": 1.0, "youden_j": -0.6757, "cvss_coverage": 1.0, "cvss_tp_weight": 89.2, "cvss_fp_weight": 80.8, "cvss_fn_weight": 155.3, "cvss_precision": 0.5247, "cvss_recall": 0.3648, "cvss_f3": 0.3763, "cvss_f3_score": 37.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 25, "recall": 0.3243 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 13, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.3514, "f1": 0.4127, "f2": 0.3736, "f2_score": 37.4, "f3": 0.3621, "f3_score": 36.2, "tpr": 0.3514, "fpr": 1.0, "youden_j": -0.6486, "cvss_coverage": 1.0, "cvss_tp_weight": 94.8, "cvss_fp_weight": 61.5, "cvss_fn_weight": 149.7, "cvss_precision": 0.6066, "cvss_recall": 0.3877, "cvss_f3": 0.4022, "cvss_f3_score": 40.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 24, "recall": 0.3514 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/data-source.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/activity-store.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 11, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6207, "recall": 0.4865, "f1": 0.5455, "f2": 0.5085, "f2_score": 50.8, "f3": 0.4972, "f3_score": 49.7, "tpr": 0.4865, "fpr": 1.0, "youden_j": -0.5135, "cvss_coverage": 1.0, "cvss_tp_weight": 128.7, "cvss_fp_weight": 72.7, "cvss_fn_weight": 115.8, "cvss_precision": 0.6391, "cvss_recall": 0.5264, "cvss_f3": 0.5358, "cvss_f3_score": 53.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 19, "recall": 0.4865 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 21, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.475, "recall": 0.5135, "f1": 0.4935, "f2": 0.5053, "f2_score": 50.5, "f3": 0.5094, "f3_score": 50.9, "tpr": 0.5135, "fpr": 1.0, "youden_j": -0.4865, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 114.3, "cvss_fn_weight": 114.4, "cvss_precision": 0.5322, "cvss_recall": 0.5321, "cvss_f3": 0.5321, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 18, "recall": 0.5135 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/status.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/data-source.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 35, "fp": 15, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.9459, "f1": 0.8046, "f2": 0.8838, "f2_score": 88.4, "f3": 0.9138, "f3_score": 91.4, "tpr": 0.9459, "fpr": 1.0, "youden_j": -0.0541, "cvss_coverage": 1.0, "cvss_tp_weight": 226.5, "cvss_fp_weight": 99.1, "cvss_fn_weight": 18.0, "cvss_precision": 0.6956, "cvss_recall": 0.9264, "cvss_f3": 0.8966, "cvss_f3_score": 89.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 2, "recall": 0.9459 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/reset-rate-limit.guard.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": "apps/api/src/crm/controllers/admin.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/admin.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 26, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.6486, "f1": 0.5517, "f2": 0.6061, "f2_score": 60.6, "f3": 0.6266, "f3_score": 62.7, "tpr": 0.6486, "fpr": 1.0, "youden_j": -0.3514, "cvss_coverage": 1.0, "cvss_tp_weight": 157.6, "cvss_fp_weight": 165.7, "cvss_fn_weight": 86.9, "cvss_precision": 0.4875, "cvss_recall": 0.6446, "cvss_f3": 0.6245, "cvss_f3_score": 62.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 13, "recall": 0.6486 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/documents.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/entities.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/reset-rate-limit.guard.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/directory-client.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/screens/admin.component.ts", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": "apps/api/src/database/seed.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/data-source.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 17, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.66, "recall": 0.8919, "f1": 0.7586, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8616, "f3_score": 86.2, "tpr": 0.8919, "fpr": 1.0, "youden_j": -0.1081, "cvss_coverage": 1.0, "cvss_tp_weight": 220.8, "cvss_fp_weight": 106.2, "cvss_fn_weight": 23.7, "cvss_precision": 0.6752, "cvss_recall": 0.9031, "cvss_f3": 0.8736, "cvss_f3_score": 87.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 4, "recall": 0.8919 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": "apps/api/src/crm/controllers/admin.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/data-source.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": "apps/api/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 36, "fp": 39, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.973, "f1": 0.6429, "f2": 0.8072, "f2_score": 80.7, "f3": 0.8824, "f3_score": 88.2, "tpr": 0.973, "fpr": 1.0, "youden_j": -0.027, "cvss_coverage": 1.0, "cvss_tp_weight": 238.0, "cvss_fp_weight": 290.0, "cvss_fn_weight": 6.5, "cvss_precision": 0.4508, "cvss_recall": 0.9734, "cvss_f3": 0.8723, "cvss_f3_score": 87.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 36, "fp": 0, "fn": 1, "recall": 0.973 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": "apps/api/src/crm/controllers/admin.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/admin.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/documents.controller.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": "apps/api/src/crm/controllers/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": "apps/api/src/crm/document-index.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/screens/escalation-queue.component.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": "apps/api/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/screens/admin.component.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-614" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 47, "fn": 30, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1296, "recall": 0.1892, "f1": 0.1538, "f2": 0.1733, "f2_score": 17.3, "f3": 0.1809, "f3_score": 18.1, "tpr": 0.1892, "fpr": 1.0, "youden_j": -0.8108, "cvss_coverage": 1.0, "cvss_tp_weight": 51.7, "cvss_fp_weight": 280.0, "cvss_fn_weight": 192.8, "cvss_precision": 0.1558, "cvss_recall": 0.2115, "cvss_f3": 0.2042, "cvss_f3_score": 20.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 30, "recall": 0.1892 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/dashboard.controller.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/dashboard.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/documents.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/controllers/organizations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-007", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-008", "file": "apps/api/src/crm/controllers/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-015", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-016", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-017", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-021", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-022", "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/crm.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/crm/directory-client.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-education-lms-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 29, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.3958, "recall": 0.3958, "f1": 0.3958, "f2": 0.3958, "f2_score": 39.6, "f3": 0.3958, "f3_score": 39.6, "tpr": 0.3958, "fpr": 1.0, "youden_j": -0.6042, "cvss_coverage": 1.0, "cvss_tp_weight": 132.6, "cvss_fp_weight": 174.6, "cvss_fn_weight": 186.9, "cvss_precision": 0.4317, "cvss_recall": 0.415, "cvss_f3": 0.4166, "cvss_f3_score": 41.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3913 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 28, "recall": 0.4043 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-directory.ts", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": "src/lib/media-intake.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/api-auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/api-auth.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollments/[enrollmentId]/transcript-registrar-copy/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/proctor/handoff/route.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/staff-directory/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/section-swap/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": "src/lib/draft-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/draft-state.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/widget-preferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-embed/route.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 10, "fn": 35, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.5652, "recall": 0.2708, "f1": 0.3662, "f2": 0.3023, "f2_score": 30.2, "f3": 0.2857, "f3_score": 28.6, "tpr": 0.2708, "fpr": 1.0, "youden_j": -0.7292, "cvss_coverage": 1.0, "cvss_tp_weight": 92.6, "cvss_fp_weight": 60.4, "cvss_fn_weight": 226.9, "cvss_precision": 0.6052, "cvss_recall": 0.2898, "cvss_f3": 0.3058, "cvss_f3_score": 30.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1304 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 34, "recall": 0.2766 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": "src/app/(workspace)/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 15, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.4444, "recall": 0.25, "f1": 0.32, "f2": 0.274, "f2_score": 27.4, "f3": 0.2614, "f3_score": 26.1, "tpr": 0.25, "fpr": 1.0, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 90.9, "cvss_fp_weight": 99.8, "cvss_fn_weight": 228.6, "cvss_precision": 0.4766, "cvss_recall": 0.2845, "cvss_f3": 0.2965, "cvss_f3_score": 29.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1304 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 35, "recall": 0.2553 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster-export/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 19, "fn": 30, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.4865, "recall": 0.375, "f1": 0.4235, "f2": 0.393, "f2_score": 39.3, "f3": 0.3838, "f3_score": 38.4, "tpr": 0.375, "fpr": 1.0, "youden_j": -0.625, "cvss_coverage": 1.0, "cvss_tp_weight": 126.2, "cvss_fp_weight": 114.2, "cvss_fn_weight": 193.3, "cvss_precision": 0.5251, "cvss_recall": 0.395, "cvss_f3": 0.405, "cvss_f3_score": 40.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3043 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 29, "recall": 0.383 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/enrollments/[enrollmentId]/certificate/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster-export/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/leave/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/lesson-planner.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 31, "fp": 52, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.3735, "recall": 0.6458, "f1": 0.4733, "f2": 0.5636, "f2_score": 56.4, "f3": 0.6019, "f3_score": 60.2, "tpr": 0.6458, "fpr": 1.0, "youden_j": -0.3542, "cvss_coverage": 1.0, "cvss_tp_weight": 220.3, "cvss_fp_weight": 346.1, "cvss_fn_weight": 99.2, "cvss_precision": 0.3889, "cvss_recall": 0.6895, "cvss_f3": 0.64, "cvss_f3_score": 64.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5652 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 16, "recall": 0.6596 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-564" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-directory.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/directory-service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/certificates.ts", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-export.ts", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": "src/lib/media-intake.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/lesson-planner.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster-export/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster-export/route.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": "src/lib/integrations.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/section-swap/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/widget-preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/widget-preferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": "src/lib/draft-state.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/draft-state.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/draft-state.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coaching-assistant.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coaching-assistant.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/device-trust/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-embed/route.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-embed/route.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": "src/db/client.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": "src/lib/data.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-313" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 22, "fp": 28, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.44, "recall": 0.4583, "f1": 0.449, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4564, "f3_score": 45.6, "tpr": 0.4583, "fpr": 1.0, "youden_j": -0.5417, "cvss_coverage": 1.0, "cvss_tp_weight": 157.2, "cvss_fp_weight": 186.4, "cvss_fn_weight": 162.3, "cvss_precision": 0.4575, "cvss_recall": 0.492, "cvss_f3": 0.4883, "cvss_f3_score": 48.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3913 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 25, "recall": 0.4681 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": "src/app/(workspace)/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/leave/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/staff-directory/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/reading-preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollments/[enrollmentId]/transcript-registrar-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/publish/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/[submissionId]/grade-history/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/grade-history/[entryId]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/device-trust/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 29, "fp": 25, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.537, "recall": 0.6042, "f1": 0.5686, "f2": 0.5894, "f2_score": 58.9, "f3": 0.5967, "f3_score": 59.7, "tpr": 0.6042, "fpr": 1.0, "youden_j": -0.3958, "cvss_coverage": 1.0, "cvss_tp_weight": 184.3, "cvss_fp_weight": 166.4, "cvss_fn_weight": 135.2, "cvss_precision": 0.5255, "cvss_recall": 0.5768, "cvss_f3": 0.5713, "cvss_f3_score": 57.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.6522 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 29, "fp": 0, "fn": 18, "recall": 0.617 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-workspace.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": "src/app/(workspace)/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/enrollments/[enrollmentId]/certificate/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-embed/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-export.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": "src/lib/draft-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": "src/lib/actions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/proctor/handoff/route.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/[submissionId]/grade-history/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollments/[enrollmentId]/transcript-registrar-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/publish/route.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/leave/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": "src/lib/integrations.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": "src/lib/data.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": "src/lib/coaching-assistant.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/route.ts", "cwe": "CWE-201" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 43, "fp": 15, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.7414, "recall": 0.8958, "f1": 0.8113, "f2": 0.86, "f2_score": 86.0, "f3": 0.8776, "f3_score": 87.8, "tpr": 0.8958, "fpr": 1.0, "youden_j": -0.1042, "cvss_coverage": 1.0, "cvss_tp_weight": 285.5, "cvss_fp_weight": 99.8, "cvss_fn_weight": 34.0, "cvss_precision": 0.7409, "cvss_recall": 0.8936, "cvss_f3": 0.8755, "cvss_f3_score": 87.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.913 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 42, "fp": 0, "fn": 5, "recall": 0.8936 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": "src/app/(workspace)/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/enrollments/[enrollmentId]/certificate/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/proctor/handoff/route.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/roster/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": "src/db/client.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": "src/lib/actions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": "src/lib/actions.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": "src/lib/actions.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": "src/lib/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coaching-assistant.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": "src/lib/data.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": "src/lib/data.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": "src/lib/draft-state.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/draft-state.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrations.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": "src/lib/integrations.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": "src/lib/integrations.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": "src/lib/media-intake.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/[submissionId]/grade-history/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/grade-history/[entryId]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollments/[enrollmentId]/transcript-registrar-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/format.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/device-trust/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/data.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 46, "fp": 46, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.5, "recall": 0.9583, "f1": 0.6571, "f2": 0.8099, "f2_score": 81.0, "f3": 0.8779, "f3_score": 87.8, "tpr": 0.9583, "fpr": 1.0, "youden_j": -0.0417, "cvss_coverage": 1.0, "cvss_tp_weight": 308.7, "cvss_fp_weight": 331.0, "cvss_fn_weight": 10.8, "cvss_precision": 0.4826, "cvss_recall": 0.9662, "cvss_f3": 0.8782, "cvss_f3_score": 87.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 22, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9565 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 46, "fp": 0, "fn": 1, "recall": 0.9787 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": "src/app/(workspace)/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(workspace)/discussions/page.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/cohorts/[cohortId]/join/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/[cohortId]/staff-directory/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/syllabus/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-embed/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/[courseId]/widget-preview/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/enrollments/[enrollmentId]/certificate/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollments/[enrollmentId]/transcript-registrar-copy/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/activity-ledger/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/enrollment-trend/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/courses/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/directory/employee-lookup/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/directory/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/directory/staff-lookup/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/exchange/cost-allocation/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/correction-notes-by-action/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/grading/correction-notes/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/device-trust/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": "src/app/api/v1/proctor/handoff/route.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/enrollment-directory/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/enrollment-feed/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": "src/app/api/v1/roster/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/roster/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/v1/submissions/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/webhooks/connectivity-check/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": "src/lib/actions.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": "src/lib/actions.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": "src/lib/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": "src/lib/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": "src/lib/catalog-directory.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/certificates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": "src/lib/certificates.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": "src/lib/certificates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": "src/lib/coaching-assistant.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": "src/lib/data.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": "src/lib/data.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": "src/lib/draft-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": "src/lib/integrations.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": "src/lib/integrations.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": "src/lib/linkpreview.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/media-intake.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": "src/lib/media-intake.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/storage.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": "src/lib/storage.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": "src/lib/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/v1/mobile/pairing/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": "src/app/api/v1/proctor/checkin/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": "src/lib/actions.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": "src/lib/data.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": "src/lib/data.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": "src/app/api/v1/grading/expedite/route.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": "src/db/client.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": "src/lib/draft-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": "src/lib/embed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": "src/lib/integrations.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/policy.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/courses/[courseId]/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 2, "fn": 48, "tn": 0, "ns": 0, "ns_gt": 2, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 13.3, "cvss_fn_weight": 319.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 23, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 47, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/actions.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/draft-state.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-029", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-039", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-047", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-048", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-049", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-050", "file": null, "cwe": "CWE-78" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-fintech-lending-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 18, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.3077, "f1": 0.3478, "f2": 0.3226, "f2_score": 32.3, "f3": 0.315, "f3_score": 31.5, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 113.7, "cvss_fn_weight": 177.2, "cvss_precision": 0.4207, "cvss_recall": 0.3179, "cvss_f3": 0.3259, "cvss_f3_score": 32.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 26, "recall": 0.3158 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 10, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.3077, "f1": 0.3934, "f2": 0.3371, "f2_score": 33.7, "f3": 0.3217, "f3_score": 32.2, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 88.9, "cvss_fp_weight": 60.5, "cvss_fn_weight": 170.9, "cvss_precision": 0.5952, "cvss_recall": 0.3422, "cvss_f3": 0.3574, "cvss_f3_score": 35.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 26, "recall": 0.3158 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 12, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.4359, "f1": 0.5, "f2": 0.4595, "f2_score": 45.9, "f3": 0.4474, "f3_score": 44.7, "tpr": 0.4359, "fpr": 1.0, "youden_j": -0.5641, "cvss_coverage": 1.0, "cvss_tp_weight": 117.0, "cvss_fp_weight": 67.6, "cvss_fn_weight": 142.8, "cvss_precision": 0.6338, "cvss_recall": 0.4503, "cvss_f3": 0.4638, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 21, "recall": 0.4474 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 23, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.425, "recall": 0.4359, "f1": 0.4304, "f2": 0.4337, "f2_score": 43.4, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4359, "fpr": 1.0, "youden_j": -0.5641, "cvss_coverage": 1.0, "cvss_tp_weight": 118.2, "cvss_fp_weight": 153.2, "cvss_fn_weight": 141.6, "cvss_precision": 0.4355, "cvss_recall": 0.455, "cvss_f3": 0.4529, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 21, "recall": 0.4474 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/entities/BorrowerPayoutAccount.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-649" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 20, "fp": 30, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.5128, "f1": 0.4494, "f2": 0.4854, "f2_score": 48.5, "f3": 0.4988, "f3_score": 49.9, "tpr": 0.5128, "fpr": 1.0, "youden_j": -0.4872, "cvss_coverage": 1.0, "cvss_tp_weight": 135.5, "cvss_fp_weight": 199.8, "cvss_fn_weight": 124.3, "cvss_precision": 0.4041, "cvss_recall": 0.5216, "cvss_f3": 0.5068, "cvss_f3_score": 50.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 18, "recall": 0.5263 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/api.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-759" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-480" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 39, "fp": 6, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 1.0, "f1": 0.9286, "f2": 0.9701, "f2_score": 97.0, "f3": 0.9848, "f3_score": 98.5, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 259.8, "cvss_fp_weight": 33.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.8849, "cvss_recall": 1.0, "cvss_f3": 0.9872, "cvss_f3_score": 98.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 38, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": "server/src/domain/policy.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": "server/src/routes/api.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": "server/src/routes/api.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/api.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/api.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/api.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/api.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": "server/src/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": "server/src/utils/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 23, "fp": 25, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4792, "recall": 0.5897, "f1": 0.5287, "f2": 0.5637, "f2_score": 56.4, "f3": 0.5764, "f3_score": 57.6, "tpr": 0.5897, "fpr": 1.0, "youden_j": -0.4103, "cvss_coverage": 1.0, "cvss_tp_weight": 151.5, "cvss_fp_weight": 166.5, "cvss_fn_weight": 108.3, "cvss_precision": 0.4764, "cvss_recall": 0.5831, "cvss_f3": 0.5704, "cvss_f3_score": 57.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.55 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 15, "recall": 0.6053 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/api.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": "server/src/domain/policy.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-834" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/api.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/api.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/directoryClient.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/security.ts", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 32, "fp": 13, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7111, "recall": 0.8205, "f1": 0.7619, "f2": 0.796, "f2_score": 79.6, "f3": 0.8081, "f3_score": 80.8, "tpr": 0.8205, "fpr": 1.0, "youden_j": -0.1795, "cvss_coverage": 1.0, "cvss_tp_weight": 213.6, "cvss_fp_weight": 74.3, "cvss_fn_weight": 46.2, "cvss_precision": 0.742, "cvss_recall": 0.8222, "cvss_f3": 0.8134, "cvss_f3_score": 81.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 32, "fp": 0, "fn": 6, "recall": 0.8421 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": "server/src/domain/policy.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/api.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/api.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/api.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/api.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": "server/src/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 36, "fp": 50, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4186, "recall": 0.9231, "f1": 0.576, "f2": 0.7438, "f2_score": 74.4, "f3": 0.8238, "f3_score": 82.4, "tpr": 0.9231, "fpr": 1.0, "youden_j": -0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 239.2, "cvss_fp_weight": 357.5, "cvss_fn_weight": 20.6, "cvss_precision": 0.4009, "cvss_recall": 0.9207, "cvss_f3": 0.815, "cvss_f3_score": 81.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.95 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 36, "fp": 0, "fn": 2, "recall": 0.9474 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": "server/src/routes/api.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": "server/src/routes/api.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": "server/src/routes/api.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": "server/src/routes/api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": "server/src/routes/api.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": "server/src/routes/api.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": "server/src/routes/api.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": "server/src/routes/api.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": "server/src/routes/api.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": "server/src/routes/api.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": "server/src/routes/api.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": "server/src/utils/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": "server/src/routes/api.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": "server/src/routes/api.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/domain/policy.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/domain/policy.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/domain/policy.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": "server/src/routes/api.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": "server/src/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": "server/src/config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": "server/src/routes/api.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 35, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.1795, "f1": 0.1728, "f2": 0.1768, "f2_score": 17.7, "f3": 0.1781, "f3_score": 17.8, "tpr": 0.1795, "fpr": 1.0, "youden_j": -0.8205, "cvss_coverage": 1.0, "cvss_tp_weight": 47.1, "cvss_fp_weight": 190.0, "cvss_fn_weight": 212.7, "cvss_precision": 0.1986, "cvss_recall": 0.1813, "cvss_f3": 0.1829, "cvss_f3_score": 18.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 31, "recall": 0.1842 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-013", "file": "server/src/routes/api.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-026", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-027", "file": "server/src/routes/api.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-028", "file": "server/src/routes/api.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-031", "file": "server/src/routes/api.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-033", "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/api.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-035", "file": "server/src/routes/api.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/directoryClient.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/draftStateCipher.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/payoutCipher.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/utils/workspaceEnvelope.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-036", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-fintech-lending-express-039", "file": null, "cwe": "CWE-611" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-healthcare-clinic-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 21, "fp": 39, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.35, "recall": 0.5, "f1": 0.4118, "f2": 0.4605, "f2_score": 46.1, "f3": 0.4795, "f3_score": 47.9, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 148.7, "cvss_fp_weight": 232.6, "cvss_fn_weight": 128.0, "cvss_precision": 0.39, "cvss_recall": 0.5374, "cvss_f3": 0.5178, "cvss_f3_score": 51.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 21, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-scope/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-scope/route.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/lobby-board-resume/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/queue-monitor-resume/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/workstation-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/workstation-board/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/triage-station-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/triage-station-board/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-roster-state.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-roster-state.ts", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/utilization-export/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/queue-view/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/queue-view/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/dme-authorization.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/dependent-link/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/diagnostics.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/request-integrity.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "components/thread-status-actions.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/login/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 12, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.52, "recall": 0.3095, "f1": 0.3881, "f2": 0.3368, "f2_score": 33.7, "f3": 0.3226, "f3_score": 32.3, "tpr": 0.3095, "fpr": 1.0, "youden_j": -0.6905, "cvss_coverage": 1.0, "cvss_tp_weight": 94.0, "cvss_fp_weight": 60.8, "cvss_fn_weight": 182.7, "cvss_precision": 0.6073, "cvss_recall": 0.3397, "cvss_f3": 0.3554, "cvss_f3_score": 35.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 29, "recall": 0.3095 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 11, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.5926, "recall": 0.381, "f1": 0.4638, "f2": 0.4103, "f2_score": 41.0, "f3": 0.3951, "f3_score": 39.5, "tpr": 0.381, "fpr": 1.0, "youden_j": -0.619, "cvss_coverage": 1.0, "cvss_tp_weight": 118.9, "cvss_fp_weight": 48.1, "cvss_fn_weight": 157.8, "cvss_precision": 0.7119, "cvss_recall": 0.4297, "cvss_f3": 0.4474, "cvss_f3_score": 44.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 26, "recall": 0.381 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/records/archive/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-scope/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-roster-state.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/utilization-export/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/coverage-chain.ts", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 19, "fp": 21, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.475, "recall": 0.4524, "f1": 0.4634, "f2": 0.4567, "f2_score": 45.7, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4524, "fpr": 1.0, "youden_j": -0.5476, "cvss_coverage": 1.0, "cvss_tp_weight": 132.0, "cvss_fp_weight": 132.3, "cvss_fn_weight": 144.7, "cvss_precision": 0.4995, "cvss_recall": 0.4771, "cvss_f3": 0.4792, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 23, "recall": 0.4524 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-roster-state.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/appointments/page.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/utilization-export/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/eligibility.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/dme-authorization.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/coverage-chain.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/lobby-board/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 25, "fp": 35, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.4167, "recall": 0.5952, "f1": 0.4902, "f2": 0.5482, "f2_score": 54.8, "f3": 0.5708, "f3_score": 57.1, "tpr": 0.5952, "fpr": 1.0, "youden_j": -0.4048, "cvss_coverage": 1.0, "cvss_tp_weight": 169.7, "cvss_fp_weight": 218.4, "cvss_fn_weight": 107.0, "cvss_precision": 0.4373, "cvss_recall": 0.6133, "cvss_f3": 0.5896, "cvss_f3_score": 59.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.45 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 17, "recall": 0.5952 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-roster-state.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": "lib/share-links.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/request-integrity.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": "app/api/documents/referral-board-search/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-scope/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-scope/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": "lib/workstation-lock.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/scheduling-ops.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/scheduling-ops.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/coverage-chain.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/coverage-chain.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": "lib/portal-linking.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/portal-linking.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/utilization-export/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/utilization-export/route.ts", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/directory/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/directory/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 42, "fp": 14, "fn": 0, "tn": 0, "ns": 2, "ns_gt": 3, "precision": 0.75, "recall": 1.0, "f1": 0.8571, "f2": 0.9375, "f2_score": 93.8, "f3": 0.9677, "f3_score": 96.8, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 276.7, "cvss_fp_weight": 92.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.75, "cvss_recall": 1.0, "cvss_f3": 0.9677, "cvss_f3_score": 96.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 42, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": "app/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": "app/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": "app/actions.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": "app/api/documents/referral-board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/thread-note/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/thread-status/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": "app/api/prescriptions/handoff-slip/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/queue-view/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": "app/api/staff/directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/appointments/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/documents/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messages/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/staff/schedule/page.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": "lib/pbm-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": "lib/portal-linking.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": "lib/request-integrity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": "lib/scheduling-ops.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": "lib/share-links.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": "lib/shift-handoff.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": "lib/workstation-lock.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 28, "fp": 34, "fn": 14, "tn": 0, "ns": 1, "ns_gt": 3, "precision": 0.4516, "recall": 0.6667, "f1": 0.5385, "f2": 0.6087, "f2_score": 60.9, "f3": 0.6364, "f3_score": 63.6, "tpr": 0.6667, "fpr": 1.0, "youden_j": -0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 193.0, "cvss_fp_weight": 224.0, "cvss_fn_weight": 83.7, "cvss_precision": 0.4628, "cvss_recall": 0.6975, "cvss_f3": 0.6638, "cvss_f3_score": 66.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 28, "fp": 0, "fn": 14, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": "app/actions.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": "app/api/documents/referral-board-search/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/directory/route.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/thread-digest/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/message-ops.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/message-ops.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/queue-view/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/staff/charts/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/staff/schedule/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/appointments/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/documents/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messages/page.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/workstation-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/triage-station-board/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": "lib/shift-handoff.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": "lib/share-links.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": "lib/pbm-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": "app/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": "lib/portal-linking.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/kiosk-passcode.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/eligibility.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/dme-authorization.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/lobby-board/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 40, "fp": 17, "fn": 2, "tn": 0, "ns": 2, "ns_gt": 3, "precision": 0.7018, "recall": 0.9524, "f1": 0.8081, "f2": 0.8889, "f2_score": 88.9, "f3": 0.9195, "f3_score": 92.0, "tpr": 0.9524, "fpr": 1.0, "youden_j": -0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 267.1, "cvss_fp_weight": 112.0, "cvss_fn_weight": 9.6, "cvss_precision": 0.7046, "cvss_recall": 0.9653, "cvss_f3": 0.9309, "cvss_f3_score": 93.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 2, "recall": 0.9524 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": "app/actions.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": "app/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": "app/actions.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": "app/api/documents/referral-board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": "app/api/prescriptions/handoff-slip/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": "app/api/staff/directory/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pbm-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": "lib/portal-linking.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": "lib/request-integrity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": "lib/scheduling-ops.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": "lib/share-links.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": "lib/shift-handoff.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": "lib/workstation-lock.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/appointments/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/staff/schedule/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/staff/charts/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/workstation-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/triage-station-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/network-access.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/dme-authorization.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/eligibility.ts", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "app/documents/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/messages/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 41, "fp": 37, "fn": 1, "tn": 0, "ns": 1, "ns_gt": 3, "precision": 0.5256, "recall": 0.9762, "f1": 0.6833, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8991, "f3_score": 89.9, "tpr": 0.9762, "fpr": 1.0, "youden_j": -0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 270.2, "cvss_fp_weight": 268.5, "cvss_fn_weight": 6.5, "cvss_precision": 0.5016, "cvss_recall": 0.9765, "cvss_f3": 0.892, "cvss_f3_score": 89.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 1, "recall": 0.9762 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": "app/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": "app/actions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": "app/actions.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": "app/api/appointments/confirm/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/lobby-board/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/dashboard/queue-monitor/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/documents/intake-packet/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/import/patients/route.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": "app/api/messages/triage-view/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/clearinghouse-packet-import/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/partners/referral-packet-import/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": "app/api/portal/billing-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/dispense-check/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": "app/api/prescriptions/handoff-slip/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/prescriptions/refill-note/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/records/archive/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/scheduling/status-transition/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/charting-station-label/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": "app/api/staff/directory/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/label-print-station/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": "lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": "lib/billing-formulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": "lib/diagnostics.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-catalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": "lib/kiosk-passcode.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": "lib/network-access.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": "lib/partner-document-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": "lib/pbm-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": "lib/portal-linking.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": "lib/reporting.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/shift-handoff.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": "lib/shift-handoff.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/shift-handoff.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": "lib/signage.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": "lib/webhooks.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": "lib/workstation-lock.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": "app/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": "app/api/portal/dependent-summary/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": "lib/pharmacy-ops.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/coverage-chain.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": "lib/referral-network.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": "lib/request-integrity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": "lib/scheduling-ops.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": "lib/share-links.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": "app/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": "app/api/documents/board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": "app/api/documents/referral-board-search/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": "app/api/records/archive/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/reports/utilization/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/triage-station-board/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/staff/workstation-board/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 28, "fn": 37, "tn": 0, "ns": 0, "ns_gt": 3, "precision": 0.1515, "recall": 0.119, "f1": 0.1333, "f2": 0.1244, "f2_score": 12.4, "f3": 0.1217, "f3_score": 12.2, "tpr": 0.119, "fpr": 1.0, "youden_j": -0.881, "cvss_coverage": 1.0, "cvss_tp_weight": 40.3, "cvss_fp_weight": 141.8, "cvss_fn_weight": 236.4, "cvss_precision": 0.2212, "cvss_recall": 0.1456, "cvss_f3": 0.1508, "cvss_f3_score": 15.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 37, "recall": 0.119 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/actions.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/documents/handoff-export/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/documents/print-label/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/api/visit-summaries/shared/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/context.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/context.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-020", "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/document-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/format.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-021", "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/forms-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-022", "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/huddle-sheets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-024", "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/label-print-station.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/pharmacy-ops.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-034", "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/reporting.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/share-links.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-451" }, { "classification": "FP", "ground_truth_id": null, "file": "lib/signage.ts", "cwe": "CWE-451" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-043", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-044", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-codex-high-seeded-v3-healthcare-clinic-nextjs-045", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-hr-payroll-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 15, "fn": 34, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3478, "recall": 0.1905, "f1": 0.2462, "f2": 0.2094, "f2_score": 20.9, "f3": 0.1995, "f3_score": 20.0, "tpr": 0.1905, "fpr": 1.0, "youden_j": -0.8095, "cvss_coverage": 1.0, "cvss_tp_weight": 61.1, "cvss_fp_weight": 98.4, "cvss_fn_weight": 232.7, "cvss_precision": 0.383, "cvss_recall": 0.208, "cvss_f3": 0.2179, "cvss_f3_score": 21.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 34, "recall": 0.1905 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 19, "fp": 22, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4634, "recall": 0.4524, "f1": 0.4578, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4535, "f3_score": 45.3, "tpr": 0.4524, "fpr": 1.0, "youden_j": -0.5476, "cvss_coverage": 1.0, "cvss_tp_weight": 133.5, "cvss_fp_weight": 114.9, "cvss_fn_weight": 160.3, "cvss_precision": 0.5374, "cvss_recall": 0.4544, "cvss_f3": 0.4615, "cvss_f3_score": 46.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 23, "recall": 0.4524 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": "app/services/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.export-copy.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import.tsx", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/partnerCors.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 18, "fp": 16, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5294, "recall": 0.4286, "f1": 0.4737, "f2": 0.4455, "f2_score": 44.6, "f3": 0.4369, "f3_score": 43.7, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 126.9, "cvss_fp_weight": 98.9, "cvss_fn_weight": 166.9, "cvss_precision": 0.5619, "cvss_recall": 0.4319, "cvss_f3": 0.4422, "cvss_f3_score": 44.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 24, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.export-copy.tsx", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": "app/services/workflows.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/partnerCors.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 24, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.4762, "f1": 0.4651, "f2": 0.4717, "f2_score": 47.2, "f3": 0.4739, "f3_score": 47.4, "tpr": 0.4762, "fpr": 1.0, "youden_j": -0.5238, "cvss_coverage": 1.0, "cvss_tp_weight": 136.5, "cvss_fp_weight": 154.9, "cvss_fn_weight": 157.3, "cvss_precision": 0.4684, "cvss_recall": 0.4646, "cvss_f3": 0.465, "cvss_f3_score": 46.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 22, "recall": 0.4762 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/templates.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.export-copy.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/partnerCors.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": "app/services/workflows.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.kiosk-preview.tsx", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 24, "fp": 33, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4211, "recall": 0.5714, "f1": 0.4848, "f2": 0.5333, "f2_score": 53.3, "f3": 0.5517, "f3_score": 55.2, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 158.1, "cvss_fp_weight": 211.4, "cvss_fn_weight": 135.7, "cvss_precision": 0.4279, "cvss_recall": 0.5381, "cvss_f3": 0.5246, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 18, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": "app/routes/exports.payroll-adjustments-reviewed.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.export-copy.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": "app/services/integrations.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/reconciliation.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": "app/services/workflows.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/partnerCors.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/partnerCors.server.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.kiosk-preview.tsx", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.kiosk-preview.tsx", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.new.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 37, "fp": 32, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5362, "recall": 0.881, "f1": 0.6667, "f2": 0.7806, "f2_score": 78.1, "f3": 0.8277, "f3_score": 82.8, "tpr": 0.881, "fpr": 1.0, "youden_j": -0.119, "cvss_coverage": 1.0, "cvss_tp_weight": 259.4, "cvss_fp_weight": 204.4, "cvss_fn_weight": 34.4, "cvss_precision": 0.5593, "cvss_recall": 0.8829, "cvss_f3": 0.8346, "cvss_f3_score": 83.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 5, "recall": 0.881 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": "app/db.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": "app/routes/exports.payroll-adjustments-reviewed.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": "app/services/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": "app/services/crypto.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": "app/services/integrations.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/reconciliation.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": "app/services/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": "app/services/workflows.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": "app/services/workflows.server.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": "app/services/workflows.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": "scripts/run-reminders.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/verify-rules.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$documentId.export-copy.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.checklist-assign-reviewed.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake-reviewed.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/ratelimit.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.new.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/devices.pair.tsx", "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 27, "fp": 29, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4821, "recall": 0.6429, "f1": 0.551, "f2": 0.6027, "f2_score": 60.3, "f3": 0.6221, "f3_score": 62.2, "tpr": 0.6429, "fpr": 1.0, "youden_j": -0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 185.4, "cvss_fp_weight": 189.9, "cvss_fn_weight": 108.4, "cvss_precision": 0.494, "cvss_recall": 0.631, "cvss_f3": 0.614, "cvss_f3_score": 61.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 15, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": "app/services/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": "app/services/auth.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.checklist-assign-reviewed.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": "app/routes/exports.payroll-adjustments-reviewed.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$employeeId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.$taskId.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": "app/services/workflows.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.new.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import.tsx", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": "app/services/integrations.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.directory-search.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.directory-search-verified.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/ratelimit.server.ts", "cwe": "CWE-401" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 25, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4681, "recall": 0.5238, "f1": 0.4944, "f2": 0.5116, "f2_score": 51.2, "f3": 0.5176, "f3_score": 51.8, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 154.4, "cvss_fp_weight": 174.9, "cvss_fn_weight": 139.4, "cvss_precision": 0.4689, "cvss_recall": 0.5255, "cvss_f3": 0.5193, "cvss_f3_score": 51.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 20, "recall": 0.5238 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_index.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": "app/services/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/ratelimit.server.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/directoryCache.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": "app/services/integrations.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.$requestId.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": "app/services/workflows.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.checklist-assign-reviewed.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake-reviewed.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": "app/routes/exports.payroll-adjustments-reviewed.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/policyIndex.server.ts", "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 41, "fp": 36, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5325, "recall": 0.9762, "f1": 0.6891, "f2": 0.8367, "f2_score": 83.7, "f3": 0.9011, "f3_score": 90.1, "tpr": 0.9762, "fpr": 1.0, "youden_j": -0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 289.5, "cvss_fp_weight": 284.5, "cvss_fn_weight": 4.3, "cvss_precision": 0.5044, "cvss_recall": 0.9854, "cvss_f3": 0.8996, "cvss_f3_score": 90.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 1, "recall": 0.9762 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": "app/components/ui.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": "app/routes/api.directory-sync.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.record.$recordId.receipt.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/devices.pair.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/directory.roster.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/directory.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": "app/routes/documents.$documentId.manifest.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.checklist-assign-reviewed.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests._index.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": "app/routes/reset-password.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": "app/services/auth.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/auth.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": "app/services/files.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/files.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": "app/services/files.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": "app/services/files.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": "app/services/integrations.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": "app/services/integrations.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": "app/services/logger.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/reconciliation.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": "app/services/reconciliation.server.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/screeningIntake.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": "app/services/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": "app/services/workflows.server.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": "app/services/workflows.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": "app/services/workflows.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": "app/services/workflows.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": "app/services/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": "app/routes/reset-password.tsx", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/integrations.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": "app/services/workflows.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": "app/db.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": "app/services/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": "app/services/crypto.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": "app/services/integrations.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": "scripts/run-reminders.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": "app/routes/exports.payroll-adjustments-reviewed.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": "app/routes/field-crew.shift-summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake-reviewed.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.screening-intake.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.processor-callback.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.processor-push.tsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 7, "fn": 38, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3636, "recall": 0.0952, "f1": 0.1509, "f2": 0.1117, "f2_score": 11.2, "f3": 0.1028, "f3_score": 10.3, "tpr": 0.0952, "fpr": 1.0, "youden_j": -0.9048, "cvss_coverage": 1.0, "cvss_tp_weight": 38.2, "cvss_fp_weight": 42.5, "cvss_fn_weight": 255.6, "cvss_precision": 0.4735, "cvss_recall": 0.13, "cvss_f3": 0.1402, "cvss_f3_score": 14.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 38, "recall": 0.0952 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-002", "file": "app/db.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/authz.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/crypto.server.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-023", "file": "app/services/files.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/reconciliation.server.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/workflows.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-040", "file": "scripts/run-reminders.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-041", "file": "scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/verify-rules.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-038", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-039", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-hr-payroll-remix-042", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-legal-case-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 16, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4839, "recall": 0.3191, "f1": 0.3846, "f2": 0.3425, "f2_score": 34.2, "f3": 0.3304, "f3_score": 33.0, "tpr": 0.3191, "fpr": 1.0, "youden_j": -0.6809, "cvss_coverage": 1.0, "cvss_tp_weight": 101.3, "cvss_fp_weight": 100.3, "cvss_fn_weight": 193.2, "cvss_precision": 0.5026, "cvss_recall": 0.344, "cvss_f3": 0.3552, "cvss_f3_score": 35.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2632 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 31, "recall": 0.3261 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": "app/lib/session.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": "app/lib/security.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 31, "fn": 30, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3542, "recall": 0.3617, "f1": 0.3579, "f2": 0.3602, "f2_score": 36.0, "f3": 0.3609, "f3_score": 36.1, "tpr": 0.3617, "fpr": 1.0, "youden_j": -0.6383, "cvss_coverage": 1.0, "cvss_tp_weight": 113.4, "cvss_fp_weight": 165.4, "cvss_fn_weight": 181.1, "cvss_precision": 0.4067, "cvss_recall": 0.3851, "cvss_f3": 0.3871, "cvss_f3_score": 38.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2105 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 29, "recall": 0.3696 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/billing.server.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/court.filing-receipts.tsx", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/court.filing-receipts.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": "app/lib/eligibility.server.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.tasks.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-87" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 15, "fn": 30, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5312, "recall": 0.3617, "f1": 0.4304, "f2": 0.3864, "f2_score": 38.6, "f3": 0.3736, "f3_score": 37.4, "tpr": 0.3617, "fpr": 1.0, "youden_j": -0.6383, "cvss_coverage": 1.0, "cvss_tp_weight": 113.4, "cvss_fp_weight": 70.9, "cvss_fn_weight": 181.1, "cvss_precision": 0.6152, "cvss_recall": 0.3851, "cvss_f3": 0.4, "cvss_f3_score": 40.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.1053 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 29, "recall": 0.3696 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$matterId.review.tsx", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 25, "fp": 20, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.5319, "f1": 0.5435, "f2": 0.5365, "f2_score": 53.6, "f3": 0.5342, "f3_score": 53.4, "tpr": 0.5319, "fpr": 1.0, "youden_j": -0.4681, "cvss_coverage": 1.0, "cvss_tp_weight": 158.5, "cvss_fp_weight": 125.3, "cvss_fn_weight": 136.0, "cvss_precision": 0.5585, "cvss_recall": 0.5382, "cvss_f3": 0.5402, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5263 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 21, "recall": 0.5435 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": "app/lib/audit.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/draft-assistant.server.ts", "cwe": "CWE-1426" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": "app/lib/eligibility.server.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-843" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": "app/lib/security.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": "app/lib/session.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/portal-claim.tsx", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": "app/routes/app.reports.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 27, "fp": 20, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5745, "recall": 0.5745, "f1": 0.5745, "f2": 0.5745, "f2_score": 57.4, "f3": 0.5745, "f3_score": 57.4, "tpr": 0.5745, "fpr": 1.0, "youden_j": -0.4255, "cvss_coverage": 1.0, "cvss_tp_weight": 169.7, "cvss_fp_weight": 119.6, "cvss_fn_weight": 124.8, "cvss_precision": 0.5867, "cvss_recall": 0.5762, "cvss_f3": 0.5773, "cvss_f3_score": 57.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4211 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 19, "recall": 0.587 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$matterId.review.tsx", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": "app/lib/session.server.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.matters.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": "app/routes/app.reports.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": "app/lib/audit.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": "app/lib/security.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/portal-claim.tsx", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": "app/routes/password-reset.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 23, "fp": 25, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4792, "recall": 0.4894, "f1": 0.4842, "f2": 0.4873, "f2_score": 48.7, "f3": 0.4883, "f3_score": 48.8, "tpr": 0.4894, "fpr": 1.0, "youden_j": -0.5106, "cvss_coverage": 1.0, "cvss_tp_weight": 145.2, "cvss_fp_weight": 156.6, "cvss_fn_weight": 149.3, "cvss_precision": 0.481, "cvss_recall": 0.493, "cvss_f3": 0.4918, "cvss_f3_score": 49.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4211 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 23, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": "app/lib/permissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/security.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/root.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.portal.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/court.filing-receipts.tsx", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/password-reset.tsx", "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 30, "fp": 22, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5769, "recall": 0.6383, "f1": 0.6061, "f2": 0.625, "f2_score": 62.5, "f3": 0.6316, "f3_score": 63.2, "tpr": 0.6383, "fpr": 1.0, "youden_j": -0.3617, "cvss_coverage": 1.0, "cvss_tp_weight": 187.9, "cvss_fp_weight": 137.9, "cvss_fn_weight": 106.6, "cvss_precision": 0.5768, "cvss_recall": 0.638, "cvss_f3": 0.6313, "cvss_f3_score": 63.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6316 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 30, "fp": 0, "fn": 16, "recall": 0.6522 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/password-reset.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": "app/lib/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": "app/lib/permissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.tsx", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.portal.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.new.tsx", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": "app/lib/audit.server.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": "app/lib/security.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 37, "fp": 17, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6852, "recall": 0.7872, "f1": 0.7327, "f2": 0.7645, "f2_score": 76.4, "f3": 0.7757, "f3_score": 77.6, "tpr": 0.7872, "fpr": 1.0, "youden_j": -0.2128, "cvss_coverage": 1.0, "cvss_tp_weight": 232.4, "cvss_fp_weight": 106.5, "cvss_fn_weight": 62.1, "cvss_precision": 0.6857, "cvss_recall": 0.7891, "cvss_f3": 0.7774, "cvss_f3_score": 77.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6842 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 9, "recall": 0.8043 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": "app/lib/audit.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": "app/lib/eligibility.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": "app/lib/permissions.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.tsx", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": "app/lib/permissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": "app/lib/session.server.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": "app/lib/session.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": "app/lib/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": "app/routes/app.tasks.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": "app/lib/workflow.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.portal.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/password-reset.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.timeline.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/csv.server.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.edit.tsx", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 41, "fp": 32, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5616, "recall": 0.8723, "f1": 0.6833, "f2": 0.7854, "f2_score": 78.5, "f3": 0.8266, "f3_score": 82.7, "tpr": 0.8723, "fpr": 1.0, "youden_j": -0.1277, "cvss_coverage": 1.0, "cvss_tp_weight": 259.5, "cvss_fp_weight": 248.5, "cvss_fn_weight": 35.0, "cvss_precision": 0.5108, "cvss_recall": 0.8812, "cvss_f3": 0.8216, "cvss_f3_score": 82.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8421 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 5, "recall": 0.8913 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": "app/lib/audit.server.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": "app/lib/audit.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": "app/lib/audit.server.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": "app/lib/billing.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": "app/lib/calendar-sync.server.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/conflict-archive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/docket-feed.server.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": "app/lib/docket-index.server.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": "app/lib/eligibility.server.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/files.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": "app/lib/filing-exchange.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": "app/lib/notice.server.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": "app/lib/permissions.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": "app/lib/security.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": "app/lib/templates.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": "app/lib/templates.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/templates.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": "app/lib/workflow.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.integrations.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.admin.users.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.documents.$documentId.convert.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.notes.$noteId.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.portal.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": "app/routes/app.reports.tsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": "app/routes/app.reports.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.reports.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.tasks.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": "app/routes/password-reset.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": "app/lib/exhibit-intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": "app/lib/permissions.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": "app/lib/session.server.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": "app/lib/session.server.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.portal.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": "app/routes/app.portal.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": "app/lib/permissions.server.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": "app/lib/ledger-gateway.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/court.filing-receipts.tsx", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 5, "fn": 46, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.0213, "f1": 0.0377, "f2": 0.0258, "f2_score": 2.6, "f3": 0.0233, "f3_score": 2.3, "tpr": 0.0213, "fpr": 1.0, "youden_j": -0.9787, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 28.8, "cvss_fn_weight": 285.7, "cvss_precision": 0.2341, "cvss_recall": 0.0299, "cvss_f3": 0.0327, "cvss_f3_score": 3.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 19, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 45, "recall": 0.0217 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/eligibility.server.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-014", "file": "app/lib/filing-conversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/retainer-memo.server.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.retainer.tsx", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/app.matters.$matterId.tsx", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-032", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-042", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-043", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-045", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-046", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-legal-case-remix-047", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 16, "fn": 28, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5152, "recall": 0.3778, "f1": 0.4359, "f2": 0.3991, "f2_score": 39.9, "f3": 0.3881, "f3_score": 38.8, "tpr": 0.3778, "fpr": 1.0, "youden_j": -0.6222, "cvss_coverage": 1.0, "cvss_tp_weight": 109.3, "cvss_fp_weight": 97.5, "cvss_fn_weight": 165.0, "cvss_precision": 0.5285, "cvss_recall": 0.3985, "cvss_f3": 0.4085, "cvss_f3_score": 40.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 28, "recall": 0.3778 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/notificationTemplates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/accountInvites.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierRates.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 13, "fn": 31, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5185, "recall": 0.3111, "f1": 0.3889, "f2": 0.3382, "f2_score": 33.8, "f3": 0.3241, "f3_score": 32.4, "tpr": 0.3111, "fpr": 1.0, "youden_j": -0.6889, "cvss_coverage": 1.0, "cvss_tp_weight": 93.5, "cvss_fp_weight": 62.5, "cvss_fn_weight": 180.8, "cvss_precision": 0.5995, "cvss_recall": 0.3409, "cvss_f3": 0.3562, "cvss_f3_score": 35.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 31, "recall": 0.3111 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierRates.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/env.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/accountInvites.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 7, "fn": 33, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.2667, "f1": 0.375, "f2": 0.3015, "f2_score": 30.2, "f3": 0.283, "f3_score": 28.3, "tpr": 0.2667, "fpr": 1.0, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 76.9, "cvss_fp_weight": 31.5, "cvss_fn_weight": 197.4, "cvss_precision": 0.7096, "cvss_recall": 0.2803, "cvss_f3": 0.2984, "cvss_f3_score": 29.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 33, "recall": 0.2667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/accountInvites.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 21, "fp": 16, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5676, "recall": 0.4667, "f1": 0.5122, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4751, "f3_score": 47.5, "tpr": 0.4667, "fpr": 1.0, "youden_j": -0.5333, "cvss_coverage": 1.0, "cvss_tp_weight": 132.1, "cvss_fp_weight": 97.5, "cvss_fn_weight": 142.2, "cvss_precision": 0.5753, "cvss_recall": 0.4816, "cvss_f3": 0.4896, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 24, "recall": 0.4667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/notificationTemplates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/regionHandoff.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/accountInvites.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/dispatchPreferences.ts", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 22, "fp": 28, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.4889, "f1": 0.4632, "f2": 0.4783, "f2_score": 47.8, "f3": 0.4835, "f3_score": 48.4, "tpr": 0.4889, "fpr": 1.0, "youden_j": -0.5111, "cvss_coverage": 1.0, "cvss_tp_weight": 141.2, "cvss_fp_weight": 142.7, "cvss_fn_weight": 133.1, "cvss_precision": 0.4974, "cvss_recall": 0.5148, "cvss_f3": 0.513, "cvss_f3_score": 51.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 23, "recall": 0.4889 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/carrierBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierRates.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/accountInvites.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/payoutMethods.ts", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "server/regionHandoff.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/incidentDrafts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/dispatchPreferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/dispatchPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/notificationTemplates.ts", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 29, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.463, "recall": 0.5556, "f1": 0.5051, "f2": 0.5342, "f2_score": 53.4, "f3": 0.5447, "f3_score": 54.5, "tpr": 0.5556, "fpr": 1.0, "youden_j": -0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 159.2, "cvss_fp_weight": 165.6, "cvss_fn_weight": 115.1, "cvss_precision": 0.4902, "cvss_recall": 0.5804, "cvss_f3": 0.5699, "cvss_f3_score": 57.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.2222 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 20, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/carrierBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/incidentDrafts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/payoutMethods.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/regionHandoff.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 34, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4138, "recall": 0.5333, "f1": 0.466, "f2": 0.5042, "f2_score": 50.4, "f3": 0.5184, "f3_score": 51.8, "tpr": 0.5333, "fpr": 1.0, "youden_j": -0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 156.3, "cvss_fp_weight": 190.5, "cvss_fn_weight": 118.0, "cvss_precision": 0.4507, "cvss_recall": 0.5698, "cvss_f3": 0.5551, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 21, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/carrierBranding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/payoutMethods.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/incidentDrafts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierRates.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/verificationCodes.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/verificationCodes.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/App.vue", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-201" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 44, "fp": 20, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.9778, "f1": 0.8073, "f2": 0.9016, "f2_score": 90.2, "f3": 0.9382, "f3_score": 93.8, "tpr": 0.9778, "fpr": 1.0, "youden_j": -0.0222, "cvss_coverage": 1.0, "cvss_tp_weight": 266.8, "cvss_fp_weight": 105.1, "cvss_fn_weight": 7.5, "cvss_precision": 0.7173, "cvss_recall": 0.9727, "cvss_f3": 0.9392, "cvss_f3_score": 93.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 9, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 44, "fp": 0, "fn": 1, "recall": 0.9778 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/carrierBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/incidentDrafts.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/routes.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/routes.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "server/routes.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/routes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/routes.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/verificationCodes.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/payoutMethods.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/facilityDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/customsManifest.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 36, "fp": 25, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5902, "recall": 0.8, "f1": 0.6792, "f2": 0.7469, "f2_score": 74.7, "f3": 0.7725, "f3_score": 77.3, "tpr": 0.8, "fpr": 1.0, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 224.8, "cvss_fp_weight": 184.0, "cvss_fn_weight": 49.5, "cvss_precision": 0.5499, "cvss_recall": 0.8195, "cvss_f3": 0.7812, "cvss_f3_score": 78.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.1111 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 36, "fp": 0, "fn": 9, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierBranding.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "server/carrierBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "server/carrierRates.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "server/carrierRates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "server/incidentQueueFilters.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "server/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "server/manifestArchive.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "server/manifestArchive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/notificationTemplates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/payoutMethods.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "server/payoutMethods.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/regionHandoff.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "server/routes.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "server/routes.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "server/routes.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "server/routes.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "server/routes.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/statusWidget.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "server/routes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "server/routes.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "server/routes.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "server/verificationCodes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/partnerConsole.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "server/routes.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "server/routes.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "server/routes.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentQueueFilters.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "server/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "server/env.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/env.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "server/incidentDrafts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "server/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 7, "fn": 43, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.0444, "f1": 0.0741, "f2": 0.0529, "f2_score": 5.3, "f3": 0.0483, "f3_score": 4.8, "tpr": 0.0444, "fpr": 1.0, "youden_j": -0.9556, "cvss_coverage": 1.0, "cvss_tp_weight": 13.1, "cvss_fp_weight": 42.7, "cvss_fn_weight": 261.2, "cvss_precision": 0.2349, "cvss_recall": 0.0478, "cvss_f3": 0.0519, "cvss_f3_score": 5.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 9, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 43, "recall": 0.0444 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/carrierAcknowledgment.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/incidentDrafts.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "server/manifestArchive.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/routes.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-039", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-330" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-marketplace-commerce-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 27, "fp": 15, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.6136, "f1": 0.6279, "f2": 0.6193, "f2_score": 61.9, "f3": 0.6164, "f3_score": 61.6, "tpr": 0.6136, "fpr": 1.0, "youden_j": -0.3864, "cvss_coverage": 1.0, "cvss_tp_weight": 172.5, "cvss_fp_weight": 90.8, "cvss_fn_weight": 93.9, "cvss_precision": 0.6551, "cvss_recall": 0.6475, "cvss_f3": 0.6483, "cvss_f3_score": 64.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 17, "recall": 0.6136 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": "src/server/orderReconciliation.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": "src/server/app.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 20, "fp": 7, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7407, "recall": 0.4545, "f1": 0.5634, "f2": 0.4926, "f2_score": 49.3, "f3": 0.4728, "f3_score": 47.3, "tpr": 0.4545, "fpr": 1.0, "youden_j": -0.5455, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 36.8, "cvss_fn_weight": 136.3, "cvss_precision": 0.7794, "cvss_recall": 0.4884, "cvss_f3": 0.5073, "cvss_f3_score": 50.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 24, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": "src/server/app.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 11, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.3864, "f1": 0.4722, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4009, "f3_score": 40.1, "tpr": 0.3864, "fpr": 1.0, "youden_j": -0.6136, "cvss_coverage": 1.0, "cvss_tp_weight": 106.6, "cvss_fp_weight": 66.6, "cvss_fn_weight": 159.8, "cvss_precision": 0.6155, "cvss_recall": 0.4002, "cvss_f3": 0.4147, "cvss_f3_score": 41.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 27, "recall": 0.3864 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 14, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.5455, "f1": 0.5854, "f2": 0.5607, "f2_score": 56.1, "f3": 0.553, "f3_score": 55.3, "tpr": 0.5455, "fpr": 1.0, "youden_j": -0.4545, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 84.8, "cvss_fn_weight": 107.8, "cvss_precision": 0.6517, "cvss_recall": 0.5953, "cvss_f3": 0.6005, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 20, "recall": 0.5455 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": null, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 44, "fp": 17, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7213, "recall": 1.0, "f1": 0.8381, "f2": 0.9283, "f2_score": 92.8, "f3": 0.9628, "f3_score": 96.3, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 266.4, "cvss_fp_weight": 102.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.7213, "cvss_recall": 1.0, "cvss_f3": 0.9628, "cvss_f3_score": 96.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 44, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": "src/server/app.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": "src/server/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": "src/server/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": "src/server/app.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": "src/server/app.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": "src/server/app.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": "src/server/app.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": "src/server/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": "src/server/orderReconciliation.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": "src/server/securityRules.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 30, "fp": 27, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5263, "recall": 0.6818, "f1": 0.5941, "f2": 0.6438, "f2_score": 64.4, "f3": 0.6623, "f3_score": 66.2, "tpr": 0.6818, "fpr": 1.0, "youden_j": -0.3182, "cvss_coverage": 1.0, "cvss_tp_weight": 192.6, "cvss_fp_weight": 157.9, "cvss_fn_weight": 73.8, "cvss_precision": 0.5495, "cvss_recall": 0.723, "cvss_f3": 0.7008, "cvss_f3_score": 70.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 30, "fp": 0, "fn": 14, "recall": 0.6818 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": "src/server/app.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/carrierExceptionSignal.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/auth.ts", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": "src/server/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": "src/server/orderReconciliation.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-497" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": "prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 39, "fp": 17, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6964, "recall": 0.8864, "f1": 0.78, "f2": 0.8405, "f2_score": 84.1, "f3": 0.8628, "f3_score": 86.3, "tpr": 0.8864, "fpr": 1.0, "youden_j": -0.1136, "cvss_coverage": 1.0, "cvss_tp_weight": 243.5, "cvss_fp_weight": 97.4, "cvss_fn_weight": 22.9, "cvss_precision": 0.7143, "cvss_recall": 0.914, "cvss_f3": 0.8892, "cvss_f3_score": 88.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 5, "recall": 0.8864 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": "src/server/app.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": "src/server/app.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": "src/server/app.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": "src/server/app.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": "src/server/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": "src/server/orderReconciliation.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": "src/server/securityRules.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 43, "fp": 44, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4943, "recall": 0.9773, "f1": 0.6565, "f2": 0.8175, "f2_score": 81.7, "f3": 0.8903, "f3_score": 89.0, "tpr": 0.9773, "fpr": 1.0, "youden_j": -0.0227, "cvss_coverage": 1.0, "cvss_tp_weight": 262.1, "cvss_fp_weight": 319.5, "cvss_fn_weight": 4.3, "cvss_precision": 0.4507, "cvss_recall": 0.9839, "cvss_f3": 0.8798, "cvss_f3_score": 88.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 43, "fp": 0, "fn": 1, "recall": 0.9773 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": "src/server/app.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": "src/server/app.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": "src/server/app.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": "src/server/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": "src/server/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/carrierExceptionSignal.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": "src/server/catalogExportConverter.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": "src/server/catalogImportPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": "src/server/disputeCaseSearch.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": "src/server/feedLinks.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": "src/server/orderReconciliation.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": "src/server/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": "src/server/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": "src/server/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": "src/server/app.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": "src/server/app.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/securityRules.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": "src/server/pricingBenchmark.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/securityRules.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 7, "fp": 22, "fn": 37, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2414, "recall": 0.1591, "f1": 0.1918, "f2": 0.1707, "f2_score": 17.1, "f3": 0.1647, "f3_score": 16.5, "tpr": 0.1591, "fpr": 1.0, "youden_j": -0.8409, "cvss_coverage": 1.0, "cvss_tp_weight": 38.9, "cvss_fp_weight": 122.1, "cvss_fn_weight": 227.5, "cvss_precision": 0.2416, "cvss_recall": 0.146, "cvss_f3": 0.152, "cvss_f3_score": 15.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 37, "recall": 0.1591 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-007", "file": "src/server/app.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-008", "file": "src/server/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-010", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-015", "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-029", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-033", "file": "src/server/app.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-043", "file": "src/server/reportRenderer.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/verificationVault.ts", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-030", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-032", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-036", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-marketplace-commerce-express-044", "file": null, "cwe": "CWE-863" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-property-management-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 18, "fp": 30, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.4286, "f1": 0.4, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4225, "f3_score": 42.3, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 113.3, "cvss_fp_weight": 180.2, "cvss_fn_weight": 155.5, "cvss_precision": 0.386, "cvss_recall": 0.4215, "cvss_f3": 0.4177, "cvss_f3_score": 41.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 23, "recall": 0.439 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/noticeBroadcast.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/paymentHistoryFiltering.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/publicEmbeds.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/leasePacketExport.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/entities/index.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/views/LoginView.vue", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/views/LoginView.vue", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/vendorFeedAccess.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/jobs/overdueNotifications.ts", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 12, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.52, "recall": 0.3095, "f1": 0.3881, "f2": 0.3368, "f2_score": 33.7, "f3": 0.3226, "f3_score": 32.3, "tpr": 0.3095, "fpr": 1.0, "youden_j": -0.6905, "cvss_coverage": 1.0, "cvss_tp_weight": 86.0, "cvss_fp_weight": 59.1, "cvss_fn_weight": 182.8, "cvss_precision": 0.5927, "cvss_recall": 0.3199, "cvss_f3": 0.3354, "cvss_f3_score": 33.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2381 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 28, "recall": 0.3171 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/sessionTokens.ts", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 22, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4359, "recall": 0.4048, "f1": 0.4198, "f2": 0.4106, "f2_score": 41.1, "f3": 0.4077, "f3_score": 40.8, "tpr": 0.4048, "fpr": 1.0, "youden_j": -0.5952, "cvss_coverage": 1.0, "cvss_tp_weight": 103.7, "cvss_fp_weight": 105.4, "cvss_fn_weight": 165.1, "cvss_precision": 0.4959, "cvss_recall": 0.3858, "cvss_f3": 0.3946, "cvss_f3_score": 39.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 25, "recall": 0.3902 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/vendorFeedAccess.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/vendorFeedAccess.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/noticeBroadcast.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/leasePacketExport.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/viewPreferences.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/publicEmbeds.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/publicEmbeds.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/escalationTrail.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 22, "fp": 18, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.55, "recall": 0.5238, "f1": 0.5366, "f2": 0.5288, "f2_score": 52.9, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 145.2, "cvss_fp_weight": 109.3, "cvss_fn_weight": 123.6, "cvss_precision": 0.5705, "cvss_recall": 0.5402, "cvss_f3": 0.5431, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.381 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 19, "recall": 0.5366 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/viewPreferences.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/leasePacketExport.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/escalationTrail.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/publicEmbeds.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/leaseReviewContext.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": "src/server/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/vendorFeedAccess.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/paymentHistoryFiltering.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/unitSearchFilters.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/noticeBroadcast.ts", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 22, "fp": 27, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.449, "recall": 0.5238, "f1": 0.4835, "f2": 0.5069, "f2_score": 50.7, "f3": 0.5152, "f3_score": 51.5, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 133.6, "cvss_fp_weight": 149.2, "cvss_fn_weight": 135.2, "cvss_precision": 0.4724, "cvss_recall": 0.497, "cvss_f3": 0.4944, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4762 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 20, "recall": 0.5122 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/noticeBroadcast.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/leasePacketExport.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": "src/server/services/renewalForecast.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/renewalForecast.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/publicEmbeds.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/inquiryDraftAssistant.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/escalationTrail.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 41, "fp": 22, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6508, "recall": 0.9762, "f1": 0.781, "f2": 0.8874, "f2_score": 88.7, "f3": 0.9297, "f3_score": 93.0, "tpr": 0.9762, "fpr": 1.0, "youden_j": -0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 261.6, "cvss_fp_weight": 140.8, "cvss_fn_weight": 7.2, "cvss_precision": 0.6501, "cvss_recall": 0.9732, "cvss_f3": 0.9271, "cvss_f3_score": 92.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 1, "recall": 0.9756 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": "src/server/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": "src/server/services/householdOccupants.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": "src/server/services/listingMedia.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": "src/server/services/renewalForecast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": "src/server/services/staffLifecycle.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": "src/server/services/workflow.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/sessionTokens.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 25, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4898, "recall": 0.5714, "f1": 0.5275, "f2": 0.553, "f2_score": 55.3, "f3": 0.5621, "f3_score": 56.2, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 144.1, "cvss_fp_weight": 160.0, "cvss_fn_weight": 124.7, "cvss_precision": 0.4739, "cvss_recall": 0.5361, "cvss_f3": 0.5291, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 18, "recall": 0.561 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": "src/server/services/listingMedia.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/sessionTokens.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": "src/server/services/workflow.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingHandoff.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 42, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 268.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": "src/server/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": "src/server/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": "src/server/services/householdOccupants.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": "src/server/services/listingMedia.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": "src/server/services/renewalForecast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": "src/server/services/renewalOfferAcceptance.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": "src/server/services/staffLifecycle.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": "src/server/services/workflow.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-1321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 38, "fp": 37, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5067, "recall": 0.9048, "f1": 0.6496, "f2": 0.7819, "f2_score": 78.2, "f3": 0.8389, "f3_score": 83.9, "tpr": 0.9048, "fpr": 1.0, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 246.8, "cvss_fp_weight": 261.5, "cvss_fn_weight": 22.0, "cvss_precision": 0.4855, "cvss_recall": 0.9182, "cvss_f3": 0.843, "cvss_f3_score": 84.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9048 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 4, "recall": 0.9024 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": "src/server/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": "src/server/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/brandingThemeAssets.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": "src/server/services/deliveryDispatchIndex.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": "src/server/services/dispatchTokens.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/escalationTrail.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": "src/server/services/householdOccupants.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": "src/server/services/inspectionChecklistLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": "src/server/services/leaseFiltering.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/listingMedia.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": "src/server/services/listingMedia.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": "src/server/services/listingSyndication.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/noticeBroadcast.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": "src/server/services/portfolioDiagnostics.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": "src/server/services/renewalFormulas.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": "src/server/services/renewalPacketArchival.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": "src/server/services/screeningBureauSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": "src/server/services/screeningLookup.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": "src/server/services/staffLifecycle.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/unitBrochureExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": "src/server/services/workflowPreferences.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": "src/server/services/householdUpdates.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": "src/server/services/leaseAmendmentIntake.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": "src/server/services/fieldTabletAccess.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": "src/server/services/supportViewSessions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/authorization.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/depositRefunds.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": "src/server/services/portalVisibility.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": "src/server/services/renewalForecast.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": "src/server/services/staffDirectory.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": "src/server/config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": "src/server/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": "src/server/services/ledgerSync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 8, "fn": 40, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.0476, "f1": 0.0769, "f2": 0.0562, "f2_score": 5.6, "f3": 0.0515, "f3_score": 5.2, "tpr": 0.0476, "fpr": 1.0, "youden_j": -0.9524, "cvss_coverage": 1.0, "cvss_tp_weight": 12.6, "cvss_fp_weight": 51.2, "cvss_fn_weight": 256.2, "cvss_precision": 0.1975, "cvss_recall": 0.0469, "cvss_f3": 0.0507, "cvss_f3_score": 5.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 39, "recall": 0.0488 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/client/views/AuditLogView.vue", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-005", "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/app.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/crypto.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server/services/gateAccess.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-031", "file": "src/server/services/reportRendering.ts", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-028", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-033", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-034", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-035", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-036", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-038", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-039", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-040", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-041", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-property-management-fastify-vue-042", "file": null, "cwe": "CWE-1321" } ] }, "sonarqube": null }, "vc-codex-high-seeded-v3-support-desk-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 18, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.2571, "f1": 0.2903, "f2": 0.2695, "f2_score": 26.9, "f3": 0.2632, "f3_score": 26.3, "tpr": 0.2571, "fpr": 1.0, "youden_j": -0.7429, "cvss_coverage": 1.0, "cvss_tp_weight": 67.4, "cvss_fp_weight": 112.6, "cvss_fn_weight": 151.6, "cvss_precision": 0.3744, "cvss_recall": 0.3078, "cvss_f3": 0.3133, "cvss_f3_score": 31.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 26, "recall": 0.2571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/notifications/notifications.service.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 11, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5926, "recall": 0.4571, "f1": 0.5161, "f2": 0.479, "f2_score": 47.9, "f3": 0.4678, "f3_score": 46.8, "tpr": 0.4571, "fpr": 1.0, "youden_j": -0.5429, "cvss_coverage": 1.0, "cvss_tp_weight": 106.0, "cvss_fp_weight": 57.3, "cvss_fn_weight": 113.0, "cvss_precision": 0.6491, "cvss_recall": 0.484, "cvss_f3": 0.4966, "cvss_f3_score": 49.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 19, "recall": 0.4571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 12, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.4286, "f1": 0.4839, "f2": 0.4491, "f2_score": 44.9, "f3": 0.4386, "f3_score": 43.9, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 96.9, "cvss_fp_weight": 75.1, "cvss_fn_weight": 122.1, "cvss_precision": 0.5634, "cvss_recall": 0.4425, "cvss_f3": 0.4522, "cvss_f3_score": 45.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 20, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 19, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4865, "recall": 0.5143, "f1": 0.5, "f2": 0.5085, "f2_score": 50.8, "f3": 0.5114, "f3_score": 51.1, "tpr": 0.5143, "fpr": 1.0, "youden_j": -0.4857, "cvss_coverage": 1.0, "cvss_tp_weight": 111.5, "cvss_fp_weight": 118.9, "cvss_fn_weight": 107.5, "cvss_precision": 0.484, "cvss_recall": 0.5091, "cvss_f3": 0.5065, "cvss_f3_score": 50.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 17, "recall": 0.5143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-1426" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/jwt-auth.guard.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/notifications/notifications.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/api.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 36, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3898, "recall": 0.6571, "f1": 0.4894, "f2": 0.5779, "f2_score": 57.8, "f3": 0.615, "f3_score": 61.5, "tpr": 0.6571, "fpr": 1.0, "youden_j": -0.3429, "cvss_coverage": 1.0, "cvss_tp_weight": 139.9, "cvss_fp_weight": 202.2, "cvss_fn_weight": 79.1, "cvss_precision": 0.4089, "cvss_recall": 0.6388, "cvss_f3": 0.6048, "cvss_f3_score": 60.5, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 12, "recall": 0.6571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-339" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/notifications/notifications.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/notifications/notifications.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/ticket-followups/ticket-followups.controller.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": "apps/api/src/common/notification.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.controller.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.guard.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 35, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 219.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 35, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": "apps/api/src/common/jwt-auth.guard.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": "apps/api/src/common/notification.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": "apps/api/src/tickets/tickets.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": "prisma/seed.ts", "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 25, "fp": 28, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4717, "recall": 0.7143, "f1": 0.5682, "f2": 0.6477, "f2_score": 64.8, "f3": 0.6793, "f3_score": 67.9, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 154.2, "cvss_fp_weight": 169.4, "cvss_fn_weight": 64.8, "cvss_precision": 0.4765, "cvss_recall": 0.7041, "cvss_f3": 0.672, "cvss_f3_score": 67.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 10, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": "apps/api/src/common/jwt-auth.guard.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.guard.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/app.component.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/ticket-followups.controller.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": "apps/api/src/common/notification.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-201" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 18, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6471, "recall": 0.9429, "f1": 0.7674, "f2": 0.8639, "f2_score": 86.4, "f3": 0.9016, "f3_score": 90.2, "tpr": 0.9429, "fpr": 1.0, "youden_j": -0.0571, "cvss_coverage": 1.0, "cvss_tp_weight": 206.0, "cvss_fp_weight": 101.1, "cvss_fn_weight": 13.0, "cvss_precision": 0.6708, "cvss_recall": 0.9406, "cvss_f3": 0.9043, "cvss_f3_score": 90.4, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 2, "recall": 0.9429 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": "apps/api/src/common/jwt-auth.guard.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": "apps/api/src/common/notification.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/workspace-session.guard.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": "apps/api/src/tickets/tickets.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/web/src/app/api.service.ts", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 32, "fp": 24, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.9143, "f1": 0.7033, "f2": 0.8163, "f2_score": 81.6, "f3": 0.8625, "f3_score": 86.3, "tpr": 0.9143, "fpr": 1.0, "youden_j": -0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 195.2, "cvss_fp_weight": 185.0, "cvss_fn_weight": 23.8, "cvss_precision": 0.5134, "cvss_recall": 0.8913, "cvss_f3": 0.8302, "cvss_f3_score": 83.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 32, "fp": 0, "fn": 3, "recall": 0.9143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": "apps/api/src/common/notification.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": "apps/api/src/integrations/integrations.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": "apps/api/src/knowledge-base/legacy-macro-importer.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": "apps/api/src/tickets/tickets.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": "apps/api/src/integrations/integrations.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": "apps/api/src/common/workspace-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": "apps/api/src/common/jwt-auth.guard.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/common/policy.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 30, "fn": 31, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1176, "recall": 0.1143, "f1": 0.1159, "f2": 0.1149, "f2_score": 11.5, "f3": 0.1146, "f3_score": 11.5, "tpr": 0.1143, "fpr": 1.0, "youden_j": -0.8857, "cvss_coverage": 1.0, "cvss_tp_weight": 28.3, "cvss_fp_weight": 187.7, "cvss_fn_weight": 190.7, "cvss_precision": 0.131, "cvss_recall": 0.1292, "cvss_f3": 0.1294, "cvss_f3_score": 12.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 31, "recall": 0.1143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/admin.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/admin/directory.client.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/auth/auth.service.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-015", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-016", "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/files/files.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-021", "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/knowledge-base/kb.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/notifications/notifications.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.controller.ts", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-024", "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/reports/reports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "apps/api/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-033", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-034", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-high-seeded-v3-support-desk-nestjs-angular-035", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-codex-seeded-v2-crm-saas-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 26, "fp": 19, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5778, "recall": 0.7647, "f1": 0.6582, "f2": 0.7182, "f2_score": 71.8, "f3": 0.7407, "f3_score": 74.1, "tpr": 0.7647, "fpr": 0.8261, "youden_j": -0.0614, "cvss_coverage": 1.0, "cvss_tp_weight": 145.2, "cvss_fp_weight": 81.3, "cvss_fn_weight": 44.4, "cvss_precision": 0.641, "cvss_recall": 0.7658, "cvss_f3": 0.7512, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 5, "recall": 0.7222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/urls.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-337", "file": "crm_platform/partner_console.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-11" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-536", "file": "crm_platform/partner_console.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": "operations/authz.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 23, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7188, "recall": 0.6765, "f1": 0.697, "f2": 0.6845, "f2_score": 68.5, "f3": 0.6805, "f3_score": 68.0, "tpr": 0.6765, "fpr": 0.6923, "youden_j": -0.0158, "cvss_coverage": 1.0, "cvss_tp_weight": 129.2, "cvss_fp_weight": 31.4, "cvss_fn_weight": 60.4, "cvss_precision": 0.8043, "cvss_recall": 0.6814, "cvss_f3": 0.692, "cvss_f3_score": 69.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.619 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-536", "file": "crm_platform/partner_console.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 10, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.4706, "f1": 0.5333, "f2": 0.4938, "f2_score": 49.4, "f3": 0.4819, "f3_score": 48.2, "tpr": 0.4706, "fpr": 0.7143, "youden_j": -0.2437, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 49.9, "cvss_fn_weight": 103.0, "cvss_precision": 0.6345, "cvss_recall": 0.4568, "cvss_f3": 0.4699, "cvss_f3_score": 47.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.4412, "f1": 0.566, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4615, "f3_score": 46.2, "tpr": 0.4412, "fpr": 0.5, "youden_j": -0.0588, "cvss_coverage": 1.0, "cvss_tp_weight": 78.1, "cvss_fp_weight": 11.0, "cvss_fn_weight": 111.5, "cvss_precision": 0.8768, "cvss_recall": 0.4119, "cvss_f3": 0.435, "cvss_f3_score": 43.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 13, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5667, "recall": 0.5, "f1": 0.5312, "f2": 0.512, "f2_score": 51.2, "f3": 0.506, "f3_score": 50.6, "tpr": 0.5, "fpr": 0.7647, "youden_j": -0.2647, "cvss_coverage": 1.0, "cvss_tp_weight": 93.1, "cvss_fp_weight": 64.9, "cvss_fn_weight": 96.5, "cvss_precision": 0.5894, "cvss_recall": 0.491, "cvss_f3": 0.4994, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4286 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 2, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8611, "recall": 0.2647, "f1": 0.4034, "f2": 0.3068, "f2_score": 30.7, "f3": 0.2843, "f3_score": 28.4, "tpr": 0.2647, "fpr": 0.2666, "youden_j": -0.002, "cvss_coverage": 1.0, "cvss_tp_weight": 50.3, "cvss_fp_weight": 7.5, "cvss_fn_weight": 139.2, "cvss_precision": 0.8743, "cvss_recall": 0.2656, "cvss_f3": 0.2852, "cvss_f3_score": 28.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.1905 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 14, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 9, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2647, "f1": 0.4186, "f2": 0.3103, "f2_score": 31.0, "f3": 0.2857, "f3_score": 28.6, "tpr": 0.2647, "fpr": 0.0, "youden_j": 0.2647, "cvss_coverage": 1.0, "cvss_tp_weight": 56.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 133.3, "cvss_precision": 1.0, "cvss_recall": 0.2969, "cvss_f3": 0.3194, "cvss_f3_score": 31.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.1905 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 15, "fp": 3, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8242, "recall": 0.4412, "f1": 0.5715, "f2": 0.4852, "f2_score": 48.5, "f3": 0.4621, "f3_score": 46.2, "tpr": 0.4412, "fpr": 0.4392, "youden_j": 0.002, "cvss_coverage": 1.0, "cvss_tp_weight": 81.1, "cvss_fp_weight": 9.2, "cvss_fn_weight": 108.5, "cvss_precision": 0.9036, "cvss_recall": 0.4279, "cvss_f3": 0.4513, "cvss_f3_score": 45.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 19, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.5588, "f1": 0.6298, "f2": 0.5852, "f2_score": 58.5, "f3": 0.5717, "f3_score": 57.2, "tpr": 0.5588, "fpr": 0.6445, "youden_j": -0.0856, "cvss_coverage": 1.0, "cvss_tp_weight": 105.2, "cvss_fp_weight": 24.6, "cvss_fn_weight": 84.4, "cvss_precision": 0.814, "cvss_recall": 0.5548, "cvss_f3": 0.5728, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4762 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 18, "fp": 10, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6589, "recall": 0.5392, "f1": 0.5923, "f2": 0.5591, "f2_score": 55.9, "f3": 0.549, "f3_score": 54.9, "tpr": 0.5392, "fpr": 0.6994, "youden_j": -0.1601, "cvss_coverage": 1.0, "cvss_tp_weight": 101.6, "cvss_fp_weight": 25.8, "cvss_fn_weight": 88.0, "cvss_precision": 0.7977, "cvss_recall": 0.5359, "cvss_f3": 0.554, "cvss_f3_score": 55.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5238 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 17, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5526, "recall": 0.6176, "f1": 0.5833, "f2": 0.6034, "f2_score": 60.3, "f3": 0.6105, "f3_score": 61.0, "tpr": 0.6176, "fpr": 0.8095, "youden_j": -0.1919, "cvss_coverage": 1.0, "cvss_tp_weight": 116.9, "cvss_fp_weight": 71.4, "cvss_fn_weight": 72.7, "cvss_precision": 0.621, "cvss_recall": 0.6166, "cvss_f3": 0.617, "cvss_f3_score": 61.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": "crm_platform/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 9, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.641, "recall": 0.4902, "f1": 0.5556, "f2": 0.5144, "f2_score": 51.5, "f3": 0.502, "f3_score": 50.2, "tpr": 0.4902, "fpr": 0.6996, "youden_j": -0.2094, "cvss_coverage": 1.0, "cvss_tp_weight": 96.0, "cvss_fp_weight": 39.1, "cvss_fn_weight": 93.6, "cvss_precision": 0.7109, "cvss_recall": 0.5062, "cvss_f3": 0.5212, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 5, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.3824, "f1": 0.5, "f2": 0.4221, "f2_score": 42.2, "f3": 0.4012, "f3_score": 40.1, "tpr": 0.3824, "fpr": 0.5556, "youden_j": -0.1732, "cvss_coverage": 1.0, "cvss_tp_weight": 66.2, "cvss_fp_weight": 20.5, "cvss_fn_weight": 123.4, "cvss_precision": 0.7639, "cvss_recall": 0.3492, "cvss_f3": 0.3692, "cvss_f3_score": 36.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 12, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.5882, "f1": 0.6061, "f2": 0.5952, "f2_score": 59.5, "f3": 0.5917, "f3_score": 59.2, "tpr": 0.5882, "fpr": 0.75, "youden_j": -0.1618, "cvss_coverage": 1.0, "cvss_tp_weight": 122.1, "cvss_fp_weight": 50.9, "cvss_fn_weight": 67.5, "cvss_precision": 0.7058, "cvss_recall": 0.644, "cvss_f3": 0.6497, "cvss_f3_score": 65.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4762 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": "crm_platform/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 6, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3529, "f1": 0.4615, "f2": 0.3896, "f2_score": 39.0, "f3": 0.3704, "f3_score": 37.0, "tpr": 0.3529, "fpr": 0.6, "youden_j": -0.2471, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 29.9, "cvss_fn_weight": 117.8, "cvss_precision": 0.7057, "cvss_recall": 0.3787, "cvss_f3": 0.3971, "cvss_f3_score": 39.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/urls.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 9, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.4706, "f1": 0.5424, "f2": 0.4969, "f2_score": 49.7, "f3": 0.4834, "f3_score": 48.3, "tpr": 0.4706, "fpr": 0.6923, "youden_j": -0.2217, "cvss_coverage": 1.0, "cvss_tp_weight": 97.9, "cvss_fp_weight": 26.9, "cvss_fn_weight": 91.7, "cvss_precision": 0.7842, "cvss_recall": 0.5164, "cvss_f3": 0.5346, "cvss_f3_score": 53.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-497" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 34, "fp": 2, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 1.0, "f1": 0.9714, "f2": 0.9884, "f2_score": 98.8, "f3": 0.9942, "f3_score": 99.4, "tpr": 1.0, "fpr": 0.3333, "youden_j": 0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 189.6, "cvss_fp_weight": 10.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.95, "cvss_recall": 1.0, "cvss_f3": 0.9948, "cvss_f3_score": 99.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-337", "file": "crm_platform/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-536", "file": "crm_platform/partner_console.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": "crm_platform/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": "operations/authz.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 6, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.718, "recall": 0.4216, "f1": 0.5278, "f2": 0.4581, "f2_score": 45.8, "f3": 0.439, "f3_score": 43.9, "tpr": 0.4216, "fpr": 0.554, "youden_j": -0.1324, "cvss_coverage": 1.0, "cvss_tp_weight": 76.7, "cvss_fp_weight": 25.4, "cvss_fn_weight": 112.9, "cvss_precision": 0.7597, "cvss_recall": 0.4047, "cvss_f3": 0.4241, "cvss_f3_score": 42.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.381 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7487, "recall": 0.4314, "f1": 0.5459, "f2": 0.4707, "f2_score": 47.1, "f3": 0.4502, "f3_score": 45.0, "tpr": 0.4314, "fpr": 0.5402, "youden_j": -0.1088, "cvss_coverage": 1.0, "cvss_tp_weight": 83.6, "cvss_fp_weight": 17.5, "cvss_fn_weight": 106.0, "cvss_precision": 0.8282, "cvss_recall": 0.4409, "cvss_f3": 0.4622, "cvss_f3_score": 46.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 10, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6101, "recall": 0.451, "f1": 0.5154, "f2": 0.4742, "f2_score": 47.4, "f3": 0.4622, "f3_score": 46.2, "tpr": 0.451, "fpr": 0.7013, "youden_j": -0.2503, "cvss_coverage": 1.0, "cvss_tp_weight": 88.5, "cvss_fp_weight": 36.6, "cvss_fn_weight": 101.1, "cvss_precision": 0.7135, "cvss_recall": 0.4666, "cvss_f3": 0.483, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2857 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7826, "recall": 0.5294, "f1": 0.6316, "f2": 0.566, "f2_score": 56.6, "f3": 0.5471, "f3_score": 54.7, "tpr": 0.5294, "fpr": 0.5556, "youden_j": -0.0261, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 11.5, "cvss_fn_weight": 90.6, "cvss_precision": 0.8961, "cvss_recall": 0.5222, "cvss_f3": 0.5449, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4762 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 20, "fp": 9, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.5882, "f1": 0.6349, "f2": 0.6061, "f2_score": 60.6, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5882, "fpr": 0.75, "youden_j": -0.1618, "cvss_coverage": 1.0, "cvss_tp_weight": 112.7, "cvss_fp_weight": 54.0, "cvss_fn_weight": 76.9, "cvss_precision": 0.6761, "cvss_recall": 0.5944, "cvss_f3": 0.6017, "cvss_f3_score": 60.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5714 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 10, "fp": 1, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 25, "fp": 59, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2976, "recall": 0.7353, "f1": 0.4237, "f2": 0.5682, "f2_score": 56.8, "f3": 0.641, "f3_score": 64.1, "tpr": 0.7353, "fpr": 0.9365, "youden_j": -0.2012, "cvss_coverage": 1.0, "cvss_tp_weight": 138.6, "cvss_fp_weight": 402.0, "cvss_fn_weight": 51.0, "cvss_precision": 0.2564, "cvss_recall": 0.731, "cvss_f3": 0.6168, "cvss_f3_score": 61.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1391" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": "operations/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 23, "fp": 27, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.46, "recall": 0.6765, "f1": 0.5476, "f2": 0.6183, "f2_score": 61.8, "f3": 0.6461, "f3_score": 64.6, "tpr": 0.6765, "fpr": 0.871, "youden_j": -0.1945, "cvss_coverage": 1.0, "cvss_tp_weight": 127.1, "cvss_fp_weight": 187.5, "cvss_fn_weight": 62.5, "cvss_precision": 0.404, "cvss_recall": 0.6704, "cvss_f3": 0.6289, "cvss_f3_score": 62.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 6, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": "operations/authz.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-174", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0588, "f1": 0.1111, "f2": 0.0725, "f2_score": 7.2, "f3": 0.0649, "f3_score": 6.5, "tpr": 0.0588, "fpr": 0.0, "youden_j": 0.0588, "cvss_coverage": 1.0, "cvss_tp_weight": 11.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 177.8, "cvss_precision": 1.0, "cvss_recall": 0.0622, "cvss_f3": 0.0687, "cvss_f3_score": 6.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-488", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-506", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 27, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4808, "recall": 0.7353, "f1": 0.5814, "f2": 0.6649, "f2_score": 66.5, "f3": 0.6983, "f3_score": 69.8, "tpr": 0.7353, "fpr": 0.871, "youden_j": -0.1357, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 191.0, "cvss_fn_weight": 54.3, "cvss_precision": 0.4146, "cvss_recall": 0.7136, "cvss_f3": 0.6656, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8095 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 30, "fp": 4, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.8824, "f1": 0.8824, "f2": 0.8824, "f2_score": 88.2, "f3": 0.8824, "f3_score": 88.2, "tpr": 0.8824, "fpr": 0.5, "youden_j": 0.3824, "cvss_coverage": 1.0, "cvss_tp_weight": 162.3, "cvss_fp_weight": 29.5, "cvss_fn_weight": 27.3, "cvss_precision": 0.8462, "cvss_recall": 0.856, "cvss_f3": 0.855, "cvss_f3_score": 85.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9048 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 2, "recall": 0.8889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": "operations/authz.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-337", "file": "crm_platform/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-536", "file": "crm_platform/partner_console.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": "crm_platform/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": "crm_platform/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 22, "fp": 48, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3143, "recall": 0.6471, "f1": 0.4231, "f2": 0.534, "f2_score": 53.4, "f3": 0.5851, "f3_score": 58.5, "tpr": 0.6471, "fpr": 0.9231, "youden_j": -0.276, "cvss_coverage": 1.0, "cvss_tp_weight": 120.5, "cvss_fp_weight": 250.5, "cvss_fn_weight": 69.1, "cvss_precision": 0.3248, "cvss_recall": 0.6355, "cvss_f3": 0.5801, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.7143 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 5, "recall": 0.7222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/authz.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 32, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4386, "recall": 0.7353, "f1": 0.5495, "f2": 0.6477, "f2_score": 64.8, "f3": 0.6887, "f3_score": 68.9, "tpr": 0.7353, "fpr": 0.8889, "youden_j": -0.1536, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 219.0, "cvss_fn_weight": 54.3, "cvss_precision": 0.3819, "cvss_recall": 0.7136, "cvss_f3": 0.6566, "cvss_f3_score": 65.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8095 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-127", "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-197", "file": "crm_platform/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-456", "file": "crm_platform/partner_console.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-476", "file": "crm_platform/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-526", "file": "crm_platform/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": "crm_platform/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": "crm_platform/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": "operations/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": "operations/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": "operations/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 4, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7311, "recall": 0.2745, "f1": 0.3971, "f2": 0.313, "f2_score": 31.3, "f3": 0.2925, "f3_score": 29.3, "tpr": 0.2745, "fpr": 0.454, "youden_j": -0.1795, "cvss_coverage": 1.0, "cvss_tp_weight": 54.5, "cvss_fp_weight": 12.3, "cvss_fn_weight": 135.1, "cvss_precision": 0.8162, "cvss_recall": 0.2874, "cvss_f3": 0.3074, "cvss_f3_score": 30.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2381 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-494", "file": "crm_platform/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-466", "file": "crm_platform/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-239", "file": "crm_platform/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-031", "file": "crm_platform/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/operations/partials/audit_table.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/operations/escalation_detail.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 189.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-174", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-488", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-506", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 0, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 189.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-174", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-488", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-506", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 23, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2069, "recall": 0.1765, "f1": 0.1905, "f2": 0.1818, "f2_score": 18.2, "f3": 0.1791, "f3_score": 17.9, "tpr": 0.1765, "fpr": 0.8519, "youden_j": -0.6754, "cvss_coverage": 1.0, "cvss_tp_weight": 36.5, "cvss_fp_weight": 74.5, "cvss_fn_weight": 153.1, "cvss_precision": 0.3288, "cvss_recall": 0.1925, "cvss_f3": 0.2008, "cvss_f3_score": 20.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.0952 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-488", "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 11, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7333, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 54.9, "cvss_fn_weight": 189.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/crm_platform/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/operations/management/commands/seed_demo.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-crm-saas-django/operations/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-032", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-033", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-174", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-277", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-488", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-506", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-516", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-546", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 38, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1556, "recall": 0.2059, "f1": 0.1772, "f2": 0.1934, "f2_score": 19.3, "f3": 0.1994, "f3_score": 19.9, "tpr": 0.2059, "fpr": 0.9048, "youden_j": -0.6989, "cvss_coverage": 1.0, "cvss_tp_weight": 35.2, "cvss_fp_weight": 198.6, "cvss_fn_weight": 154.4, "cvss_precision": 0.1505, "cvss_recall": 0.1857, "cvss_f3": 0.1814, "cvss_f3_score": 18.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.0952 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 13, "recall": 0.2778 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-032", "file": "crm_platform/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-033", "file": "crm_platform/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-174", "file": "crm_platform/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-277", "file": "crm_platform/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-506", "file": "crm_platform/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-516", "file": "crm_platform/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-546", "file": "crm_platform/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/partner_console.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "crm_platform/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "operations/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-031", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-127", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-197", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-239", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-337", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-456", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-466", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-476", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-488", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-494", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-526", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-536", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-009", "file": null, "cwe": "CWE-285" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-013", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-crm-saas-django-enrich-015", "file": null, "cwe": "CWE-312" } ] } }, "vc-codex-seeded-v2-education-lms-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 24, "fp": 18, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.6857, "f1": 0.6234, "f2": 0.6593, "f2_score": 65.9, "f3": 0.6723, "f3_score": 67.2, "tpr": 0.6857, "fpr": 0.8182, "youden_j": -0.1325, "cvss_coverage": 1.0, "cvss_tp_weight": 134.3, "cvss_fp_weight": 79.4, "cvss_fn_weight": 56.8, "cvss_precision": 0.6285, "cvss_recall": 0.7028, "cvss_f3": 0.6946, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-537", "file": "config/course_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-338", "file": "config/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 9, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.4571, "f1": 0.5333, "f2": 0.4848, "f2_score": 48.5, "f3": 0.4706, "f3_score": 47.1, "tpr": 0.4571, "fpr": 0.6923, "youden_j": -0.2352, "cvss_coverage": 1.0, "cvss_tp_weight": 88.7, "cvss_fp_weight": 35.3, "cvss_fn_weight": 102.4, "cvss_precision": 0.7153, "cvss_recall": 0.4642, "cvss_f3": 0.481, "cvss_f3_score": 48.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 3, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2571, "f1": 0.383, "f2": 0.2961, "f2_score": 29.6, "f3": 0.2752, "f3_score": 27.5, "tpr": 0.2571, "fpr": 0.4286, "youden_j": -0.1714, "cvss_coverage": 1.0, "cvss_tp_weight": 55.5, "cvss_fp_weight": 10.3, "cvss_fn_weight": 135.6, "cvss_precision": 0.8435, "cvss_recall": 0.2904, "cvss_f3": 0.3108, "cvss_f3_score": 31.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 5, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6875, "recall": 0.3143, "f1": 0.4314, "f2": 0.3526, "f2_score": 35.3, "f3": 0.3323, "f3_score": 33.2, "tpr": 0.3143, "fpr": 0.5556, "youden_j": -0.2413, "cvss_coverage": 1.0, "cvss_tp_weight": 64.5, "cvss_fp_weight": 11.3, "cvss_fn_weight": 126.6, "cvss_precision": 0.8509, "cvss_recall": 0.3375, "cvss_f3": 0.3592, "cvss_f3_score": 35.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 5, "fp": 0, "fn": 16, "recall": 0.2381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 15, "fp": 9, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.4286, "f1": 0.5085, "f2": 0.4573, "f2_score": 45.7, "f3": 0.4425, "f3_score": 44.2, "tpr": 0.4286, "fpr": 0.6923, "youden_j": -0.2637, "cvss_coverage": 1.0, "cvss_tp_weight": 82.8, "cvss_fp_weight": 39.7, "cvss_fn_weight": 108.3, "cvss_precision": 0.6759, "cvss_recall": 0.4333, "cvss_f3": 0.4494, "cvss_f3_score": 44.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 8, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2429, "f1": 0.3889, "f2": 0.2857, "f2_score": 28.5, "f3": 0.2626, "f3_score": 26.2, "tpr": 0.2429, "fpr": 0.0, "youden_j": 0.2429, "cvss_coverage": 1.0, "cvss_tp_weight": 52.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 138.5, "cvss_precision": 1.0, "cvss_recall": 0.2752, "cvss_f3": 0.2965, "cvss_f3_score": 29.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-220", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 1, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.2286, "f1": 0.3636, "f2": 0.2685, "f2_score": 26.8, "f3": 0.2469, "f3_score": 24.7, "tpr": 0.2286, "fpr": 0.2, "youden_j": 0.0286, "cvss_coverage": 1.0, "cvss_tp_weight": 49.2, "cvss_fp_weight": 0.5, "cvss_fn_weight": 141.9, "cvss_precision": 0.9899, "cvss_recall": 0.2575, "cvss_f3": 0.278, "cvss_f3_score": 27.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 3, "fp": 0, "fn": 18, "recall": 0.1429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-220", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 4, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7518, "recall": 0.3524, "f1": 0.4751, "f2": 0.3926, "f2_score": 39.3, "f3": 0.3714, "f3_score": 37.1, "tpr": 0.3524, "fpr": 0.4963, "youden_j": -0.1439, "cvss_coverage": 1.0, "cvss_tp_weight": 69.3, "cvss_fp_weight": 18.3, "cvss_fn_weight": 121.8, "cvss_precision": 0.7981, "cvss_recall": 0.3626, "cvss_f3": 0.383, "cvss_f3_score": 38.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 6, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.4381, "f1": 0.5449, "f2": 0.4753, "f2_score": 47.5, "f3": 0.4559, "f3_score": 45.6, "tpr": 0.4381, "fpr": 0.5889, "youden_j": -0.1508, "cvss_coverage": 1.0, "cvss_tp_weight": 86.3, "cvss_fp_weight": 22.1, "cvss_fn_weight": 104.8, "cvss_precision": 0.7971, "cvss_recall": 0.4514, "cvss_f3": 0.4719, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7807, "recall": 0.4667, "f1": 0.5828, "f2": 0.5069, "f2_score": 50.7, "f3": 0.4859, "f3_score": 48.6, "tpr": 0.4667, "fpr": 0.5281, "youden_j": -0.0614, "cvss_coverage": 1.0, "cvss_tp_weight": 92.9, "cvss_fp_weight": 14.1, "cvss_fn_weight": 98.2, "cvss_precision": 0.8688, "cvss_recall": 0.4863, "cvss_f3": 0.5085, "cvss_f3_score": 50.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 14, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.6, "f1": 0.6, "f2": 0.6, "f2_score": 60.0, "f3": 0.6, "f3_score": 60.0, "tpr": 0.6, "fpr": 0.7778, "youden_j": -0.1778, "cvss_coverage": 1.0, "cvss_tp_weight": 118.5, "cvss_fp_weight": 42.2, "cvss_fn_weight": 72.6, "cvss_precision": 0.7374, "cvss_recall": 0.6201, "cvss_f3": 0.6301, "cvss_f3_score": 63.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 12, "fp": 0, "fn": 9, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-537", "file": "config/course_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 7, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6522, "recall": 0.3905, "f1": 0.4863, "f2": 0.4236, "f2_score": 42.4, "f3": 0.4064, "f3_score": 40.6, "tpr": 0.3905, "fpr": 0.6429, "youden_j": -0.2524, "cvss_coverage": 1.0, "cvss_tp_weight": 78.6, "cvss_fp_weight": 25.7, "cvss_fn_weight": 112.5, "cvss_precision": 0.7596, "cvss_recall": 0.4115, "cvss_f3": 0.4307, "cvss_f3_score": 43.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.375 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/lms/partials/submission_table.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 12, "fp": 3, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.3429, "f1": 0.48, "f2": 0.3871, "f2_score": 38.7, "f3": 0.3636, "f3_score": 36.4, "tpr": 0.3429, "fpr": 0.4286, "youden_j": -0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 66.2, "cvss_fp_weight": 5.9, "cvss_fn_weight": 124.9, "cvss_precision": 0.9182, "cvss_recall": 0.3464, "cvss_f3": 0.3694, "cvss_f3_score": 36.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 34, "fp": 9, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7907, "recall": 0.9714, "f1": 0.8718, "f2": 0.929, "f2_score": 92.9, "f3": 0.9497, "f3_score": 95.0, "tpr": 0.9714, "fpr": 0.6923, "youden_j": 0.2791, "cvss_coverage": 1.0, "cvss_tp_weight": 187.4, "cvss_fp_weight": 39.7, "cvss_fn_weight": 3.7, "cvss_precision": 0.8252, "cvss_recall": 0.9806, "cvss_f3": 0.9625, "cvss_f3_score": 96.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9583 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 20, "fp": 0, "fn": 1, "recall": 0.9524 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-338", "file": "config/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-457", "file": "config/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 10, "fp": 5, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.2857, "f1": 0.4, "f2": 0.3226, "f2_score": 32.3, "f3": 0.303, "f3_score": 30.3, "tpr": 0.2857, "fpr": 0.5556, "youden_j": -0.2698, "cvss_coverage": 1.0, "cvss_tp_weight": 61.9, "cvss_fp_weight": 15.7, "cvss_fn_weight": 129.2, "cvss_precision": 0.7977, "cvss_recall": 0.3239, "cvss_f3": 0.3444, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 7, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4, "f1": 0.5, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4167, "f3_score": 41.7, "tpr": 0.4, "fpr": 0.6364, "youden_j": -0.2364, "cvss_coverage": 1.0, "cvss_tp_weight": 91.6, "cvss_fp_weight": 25.5, "cvss_fn_weight": 99.5, "cvss_precision": 0.7822, "cvss_recall": 0.4793, "cvss_f3": 0.4986, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": "lms/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/lms/partials/submission_table.html", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 35, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 191.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 24, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 21, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-338", "file": "config/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-457", "file": "config/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-537", "file": "config/course_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 3, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.805, "recall": 0.3143, "f1": 0.4507, "f2": 0.3575, "f2_score": 35.8, "f3": 0.3345, "f3_score": 33.5, "tpr": 0.3143, "fpr": 0.3968, "youden_j": -0.0825, "cvss_coverage": 1.0, "cvss_tp_weight": 62.6, "cvss_fp_weight": 10.1, "cvss_fn_weight": 128.5, "cvss_precision": 0.8603, "cvss_recall": 0.3277, "cvss_f3": 0.3493, "cvss_f3_score": 34.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 5, "fp": 0, "fn": 16, "recall": 0.2381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-220", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 11, "fp": 4, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7453, "recall": 0.3048, "f1": 0.4322, "f2": 0.3455, "f2_score": 34.6, "f3": 0.3238, "f3_score": 32.4, "tpr": 0.3048, "fpr": 0.4762, "youden_j": -0.1714, "cvss_coverage": 1.0, "cvss_tp_weight": 62.3, "cvss_fp_weight": 7.7, "cvss_fn_weight": 128.8, "cvss_precision": 0.8914, "cvss_recall": 0.3258, "cvss_f3": 0.3478, "cvss_f3_score": 34.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.25 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 10, "fp": 4, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.2857, "f1": 0.4082, "f2": 0.3247, "f2_score": 32.5, "f3": 0.304, "f3_score": 30.4, "tpr": 0.2857, "fpr": 0.5, "youden_j": -0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 60.3, "cvss_fp_weight": 10.8, "cvss_fn_weight": 130.8, "cvss_precision": 0.8481, "cvss_recall": 0.3155, "cvss_f3": 0.3367, "cvss_f3_score": 33.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2083 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 5, "fp": 0, "fn": 16, "recall": 0.2381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 9, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5143, "f1": 0.5806, "f2": 0.5389, "f2_score": 53.9, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5143, "fpr": 0.6923, "youden_j": -0.178, "cvss_coverage": 1.0, "cvss_tp_weight": 101.5, "cvss_fp_weight": 22.1, "cvss_fn_weight": 89.6, "cvss_precision": 0.8212, "cvss_recall": 0.5311, "cvss_f3": 0.5506, "cvss_f3_score": 55.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.4583 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 16, "fp": 2, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4571, "f1": 0.6038, "f2": 0.5063, "f2_score": 50.6, "f3": 0.4805, "f3_score": 48.0, "tpr": 0.4571, "fpr": 0.3333, "youden_j": 0.1238, "cvss_coverage": 1.0, "cvss_tp_weight": 91.7, "cvss_fp_weight": 4.0, "cvss_fn_weight": 99.4, "cvss_precision": 0.9582, "cvss_recall": 0.4799, "cvss_f3": 0.5051, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-248" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 24, "fp": 28, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.6857, "f1": 0.5517, "f2": 0.625, "f2_score": 62.5, "f3": 0.654, "f3_score": 65.4, "tpr": 0.6857, "fpr": 0.9032, "youden_j": -0.2175, "cvss_coverage": 1.0, "cvss_tp_weight": 129.5, "cvss_fp_weight": 172.5, "cvss_fn_weight": 61.6, "cvss_precision": 0.4288, "cvss_recall": 0.6777, "cvss_f3": 0.6405, "cvss_f3_score": 64.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 16, "fp": 1, "fn": 5, "recall": 0.7619 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": "lms/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-175", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 25, "fp": 18, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5814, "recall": 0.7143, "f1": 0.641, "f2": 0.6831, "f2_score": 68.3, "f3": 0.6983, "f3_score": 69.8, "tpr": 0.7143, "fpr": 0.8182, "youden_j": -0.1039, "cvss_coverage": 1.0, "cvss_tp_weight": 145.7, "cvss_fp_weight": 93.5, "cvss_fn_weight": 45.4, "cvss_precision": 0.6091, "cvss_recall": 0.7624, "cvss_f3": 0.7437, "cvss_f3_score": 74.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "medium": { "tp": 12, "fp": 0, "fn": 9, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/services.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 1, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.1143, "f1": 0.2, "f2": 0.1379, "f2_score": 13.8, "f3": 0.125, "f3_score": 12.5, "tpr": 0.1143, "fpr": 0.2, "youden_j": -0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 25.1, "cvss_fp_weight": 2.0, "cvss_fn_weight": 166.0, "cvss_precision": 0.9262, "cvss_recall": 0.1313, "cvss_f3": 0.1437, "cvss_f3_score": 14.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 2, "fp": 0, "fn": 19, "recall": 0.0952 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-151", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-489", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-501", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-519", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 22, "fp": 32, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4074, "recall": 0.6286, "f1": 0.4944, "f2": 0.567, "f2_score": 56.7, "f3": 0.5962, "f3_score": 59.6, "tpr": 0.6286, "fpr": 0.8889, "youden_j": -0.2603, "cvss_coverage": 1.0, "cvss_tp_weight": 124.8, "cvss_fp_weight": 227.5, "cvss_fn_weight": 66.3, "cvss_precision": 0.3542, "cvss_recall": 0.6531, "cvss_f3": 0.6023, "cvss_f3_score": 60.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 13, "fp": 0, "fn": 8, "recall": 0.619 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/lms/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 30, "fp": 9, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.8571, "f1": 0.8108, "f2": 0.838, "f2_score": 83.8, "f3": 0.8475, "f3_score": 84.7, "tpr": 0.8571, "fpr": 0.6923, "youden_j": 0.1648, "cvss_coverage": 1.0, "cvss_tp_weight": 164.2, "cvss_fp_weight": 69.5, "cvss_fn_weight": 26.9, "cvss_precision": 0.7026, "cvss_recall": 0.8592, "cvss_f3": 0.8405, "cvss_f3_score": 84.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 18, "fp": 0, "fn": 3, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-035", "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-338", "file": "config/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-457", "file": "config/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": "lms/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-537", "file": "config/course_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": "lms/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 18, "fp": 13, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5806, "recall": 0.5143, "f1": 0.5455, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5202, "f3_score": 52.0, "tpr": 0.5143, "fpr": 0.7647, "youden_j": -0.2504, "cvss_coverage": 1.0, "cvss_tp_weight": 104.7, "cvss_fp_weight": 60.0, "cvss_fn_weight": 86.4, "cvss_precision": 0.6357, "cvss_recall": 0.5479, "cvss_f3": 0.5556, "cvss_f3_score": 55.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.4167 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 11, "fp": 0, "fn": 10, "recall": 0.5238 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": "lms/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 23, "fp": 41, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3594, "recall": 0.6571, "f1": 0.4646, "f2": 0.5637, "f2_score": 56.4, "f3": 0.6069, "f3_score": 60.7, "tpr": 0.6571, "fpr": 0.9111, "youden_j": -0.254, "cvss_coverage": 1.0, "cvss_tp_weight": 130.1, "cvss_fp_weight": 284.5, "cvss_fn_weight": 61.0, "cvss_precision": 0.3138, "cvss_recall": 0.6808, "cvss_f3": 0.6095, "cvss_f3_score": 61.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.625 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-198", "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-338", "file": "config/course_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-527", "file": "config/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": "lms/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": "lms/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/lms/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 9, "fn": 26, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5444, "recall": 0.2476, "f1": 0.3291, "f2": 0.2736, "f2_score": 27.4, "f3": 0.2598, "f3_score": 26.0, "tpr": 0.2476, "fpr": 0.6768, "youden_j": -0.4292, "cvss_coverage": 1.0, "cvss_tp_weight": 53.3, "cvss_fp_weight": 42.8, "cvss_fn_weight": 137.8, "cvss_precision": 0.6119, "cvss_recall": 0.2787, "cvss_f3": 0.2927, "cvss_f3_score": 29.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.125 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 2, "fp": 1, "fn": 19, "recall": 0.0952 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-220", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 8, "fp": 11, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4211, "recall": 0.2286, "f1": 0.2963, "f2": 0.2516, "f2_score": 25.2, "f3": 0.2395, "f3_score": 24.0, "tpr": 0.2286, "fpr": 0.7333, "youden_j": -0.5048, "cvss_coverage": 1.0, "cvss_tp_weight": 49.7, "cvss_fp_weight": 40.7, "cvss_fn_weight": 141.4, "cvss_precision": 0.5498, "cvss_recall": 0.2601, "cvss_f3": 0.2745, "cvss_f3_score": 27.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 2, "fp": 0, "fn": 19, "recall": 0.0952 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/forms.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-794" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/templates/lms/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/models.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 10, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5652, "recall": 0.3714, "f1": 0.4483, "f2": 0.3988, "f2_score": 39.9, "f3": 0.3846, "f3_score": 38.5, "tpr": 0.3714, "fpr": 0.7143, "youden_j": -0.3429, "cvss_coverage": 1.0, "cvss_tp_weight": 73.0, "cvss_fp_weight": 27.0, "cvss_fn_weight": 118.1, "cvss_precision": 0.73, "cvss_recall": 0.382, "cvss_f3": 0.4011, "cvss_f3_score": 40.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2917 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-034", "file": "config/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-151", "file": "config/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-036", "file": "config/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-477", "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-467", "file": "config/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 28, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2, "recall": 0.2, "f1": 0.2, "f2": 0.2, "f2_score": 20.0, "f3": 0.2, "f3_score": 20.0, "tpr": 0.2, "fpr": 0.875, "youden_j": -0.675, "cvss_coverage": 1.0, "cvss_tp_weight": 43.9, "cvss_fp_weight": 72.0, "cvss_fn_weight": 147.2, "cvss_precision": 0.3788, "cvss_recall": 0.2297, "cvss_f3": 0.2391, "cvss_f3_score": 23.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 3, "fp": 0, "fn": 18, "recall": 0.1429 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-519", "file": "config/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-489", "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-151", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 8, "fn": 35, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6667, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 39.2, "cvss_fn_weight": 191.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 24, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 21, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-education-lms-django/config/course_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-151", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-175", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-220", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-278", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-489", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-501", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-509", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-519", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-547", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 40, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1304, "recall": 0.1714, "f1": 0.1481, "f2": 0.1613, "f2_score": 16.1, "f3": 0.1662, "f3_score": 16.6, "tpr": 0.1714, "fpr": 0.9091, "youden_j": -0.7377, "cvss_coverage": 1.0, "cvss_tp_weight": 32.1, "cvss_fp_weight": 205.2, "cvss_fn_weight": 159.0, "cvss_precision": 0.1353, "cvss_recall": 0.168, "cvss_f3": 0.164, "cvss_f3_score": 16.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0833 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-175", "file": "config/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-220", "file": "config/course_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-278", "file": "config/course_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-501", "file": "config/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-509", "file": "config/course_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-547", "file": "config/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/course_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/management/commands/seed_lms.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-034", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-035", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-151", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-198", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-338", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-457", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-467", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-477", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-489", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-519", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-527", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-537", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-011", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-012", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-013", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-enrich-016", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] } }, "vc-codex-seeded-v2-fintech-lending-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 14, "fp": 7, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3784, "f1": 0.4828, "f2": 0.4142, "f2_score": 41.4, "f3": 0.3955, "f3_score": 39.5, "tpr": 0.3784, "fpr": 0.6364, "youden_j": -0.258, "cvss_coverage": 1.0, "cvss_tp_weight": 75.0, "cvss_fp_weight": 36.5, "cvss_fn_weight": 138.7, "cvss_precision": 0.6727, "cvss_recall": 0.351, "cvss_f3": 0.3686, "cvss_f3_score": 36.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 9, "fp": 0, "fn": 13, "recall": 0.4091 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-037", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-538", "file": "backend/app/loan_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 5, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.2703, "f1": 0.3846, "f2": 0.3067, "f2_score": 30.7, "f3": 0.2874, "f3_score": 28.7, "tpr": 0.2703, "fpr": 0.5556, "youden_j": -0.2853, "cvss_coverage": 1.0, "cvss_tp_weight": 55.8, "cvss_fp_weight": 21.3, "cvss_fn_weight": 157.9, "cvss_precision": 0.7233, "cvss_recall": 0.2611, "cvss_f3": 0.2789, "cvss_f3_score": 27.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-538", "file": "backend/app/loan_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 2, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4324, "f1": 0.5818, "f2": 0.4819, "f2_score": 48.2, "f3": 0.4558, "f3_score": 45.6, "tpr": 0.4324, "fpr": 0.3333, "youden_j": 0.0991, "cvss_coverage": 1.0, "cvss_tp_weight": 96.5, "cvss_fp_weight": 5.7, "cvss_fn_weight": 117.2, "cvss_precision": 0.9441, "cvss_recall": 0.4516, "cvss_f3": 0.4764, "cvss_f3_score": 47.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 8, "fp": 0, "fn": 14, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 18, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.4865, "f1": 0.6102, "f2": 0.5294, "f2_score": 52.9, "f3": 0.507, "f3_score": 50.7, "tpr": 0.4865, "fpr": 0.5, "youden_j": -0.0135, "cvss_coverage": 1.0, "cvss_tp_weight": 107.8, "cvss_fp_weight": 16.1, "cvss_fn_weight": 105.9, "cvss_precision": 0.8698, "cvss_recall": 0.5044, "cvss_f3": 0.5266, "cvss_f3_score": 52.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 13, "recall": 0.4091 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 5, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.4324, "f1": 0.5517, "f2": 0.4734, "f2_score": 47.3, "f3": 0.452, "f3_score": 45.2, "tpr": 0.4324, "fpr": 0.5556, "youden_j": -0.1231, "cvss_coverage": 1.0, "cvss_tp_weight": 89.7, "cvss_fp_weight": 16.6, "cvss_fn_weight": 124.0, "cvss_precision": 0.8435, "cvss_recall": 0.4197, "cvss_f3": 0.442, "cvss_f3_score": 44.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 10, "fp": 0, "fn": 12, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 1, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9322, "recall": 0.3783, "f1": 0.5363, "f2": 0.4287, "f2_score": 42.9, "f3": 0.402, "f3_score": 40.2, "tpr": 0.3783, "fpr": 0.2, "youden_j": 0.1784, "cvss_coverage": 1.0, "cvss_tp_weight": 90.3, "cvss_fp_weight": 2.9, "cvss_fn_weight": 123.4, "cvss_precision": 0.9724, "cvss_recall": 0.4225, "cvss_f3": 0.4475, "cvss_f3_score": 44.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 0, "fn": 18, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 14, "fp": 2, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.3784, "f1": 0.5283, "f2": 0.4268, "f2_score": 42.7, "f3": 0.4011, "f3_score": 40.1, "tpr": 0.3784, "fpr": 0.3333, "youden_j": 0.045, "cvss_coverage": 1.0, "cvss_tp_weight": 83.7, "cvss_fp_weight": 1.0, "cvss_fn_weight": 130.0, "cvss_precision": 0.9882, "cvss_recall": 0.3917, "cvss_f3": 0.4168, "cvss_f3_score": 41.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2273 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 15, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8715, "recall": 0.4054, "f1": 0.5522, "f2": 0.4535, "f2_score": 45.3, "f3": 0.4281, "f3_score": 42.8, "tpr": 0.4054, "fpr": 0.3185, "youden_j": 0.0869, "cvss_coverage": 1.0, "cvss_tp_weight": 93.2, "cvss_fp_weight": 4.3, "cvss_fn_weight": 120.5, "cvss_precision": 0.9569, "cvss_recall": 0.4359, "cvss_f3": 0.461, "cvss_f3_score": 46.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 19, "fp": 7, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7251, "recall": 0.5225, "f1": 0.6073, "f2": 0.5534, "f2_score": 55.3, "f3": 0.5375, "f3_score": 53.7, "tpr": 0.5225, "fpr": 0.6429, "youden_j": -0.1204, "cvss_coverage": 1.0, "cvss_tp_weight": 117.4, "cvss_fp_weight": 25.7, "cvss_fn_weight": 96.3, "cvss_precision": 0.8197, "cvss_recall": 0.5492, "cvss_f3": 0.5679, "cvss_f3_score": 56.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 13, "recall": 0.4091 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 18, "fp": 11, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6254, "recall": 0.4775, "f1": 0.5374, "f2": 0.499, "f2_score": 49.9, "f3": 0.4879, "f3_score": 48.8, "tpr": 0.4775, "fpr": 0.7399, "youden_j": -0.2624, "cvss_coverage": 1.0, "cvss_tp_weight": 109.0, "cvss_fp_weight": 43.2, "cvss_fn_weight": 104.7, "cvss_precision": 0.7319, "cvss_recall": 0.5101, "cvss_f3": 0.5246, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 16, "fp": 14, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.4324, "f1": 0.4776, "f2": 0.4494, "f2_score": 44.9, "f3": 0.4408, "f3_score": 44.1, "tpr": 0.4324, "fpr": 0.7778, "youden_j": -0.3453, "cvss_coverage": 1.0, "cvss_tp_weight": 90.3, "cvss_fp_weight": 54.1, "cvss_fn_weight": 123.4, "cvss_precision": 0.6253, "cvss_recall": 0.4226, "cvss_f3": 0.4367, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.4091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 13, "recall": 0.4091 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-037", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 6, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7244, "recall": 0.4504, "f1": 0.5528, "f2": 0.4861, "f2_score": 48.6, "f3": 0.4676, "f3_score": 46.8, "tpr": 0.4504, "fpr": 0.6095, "youden_j": -0.159, "cvss_coverage": 1.0, "cvss_tp_weight": 103.8, "cvss_fp_weight": 18.8, "cvss_fn_weight": 109.9, "cvss_precision": 0.8482, "cvss_recall": 0.4859, "cvss_f3": 0.5068, "cvss_f3_score": 50.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2273 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 9, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2432, "f1": 0.3913, "f2": 0.2866, "f2_score": 28.7, "f3": 0.2632, "f3_score": 26.3, "tpr": 0.2432, "fpr": 0.0, "youden_j": 0.2432, "cvss_coverage": 1.0, "cvss_tp_weight": 51.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 162.5, "cvss_precision": 1.0, "cvss_recall": 0.2396, "cvss_f3": 0.2593, "cvss_f3_score": 25.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 4, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8788, "recall": 0.7838, "f1": 0.8286, "f2": 0.8011, "f2_score": 80.1, "f3": 0.7923, "f3_score": 79.2, "tpr": 0.7838, "fpr": 0.5, "youden_j": 0.2838, "cvss_coverage": 1.0, "cvss_tp_weight": 161.7, "cvss_fp_weight": 20.8, "cvss_fn_weight": 52.0, "cvss_precision": 0.8858, "cvss_recall": 0.7567, "cvss_f3": 0.7679, "cvss_f3_score": 76.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 20, "fp": 0, "fn": 2, "recall": 0.9091 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-037", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-538", "file": "backend/app/loan_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 11, "fp": 1, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 0.2973, "f1": 0.449, "f2": 0.3438, "f2_score": 34.4, "f3": 0.3188, "f3_score": 31.9, "tpr": 0.2973, "fpr": 0.2, "youden_j": 0.0973, "cvss_coverage": 1.0, "cvss_tp_weight": 65.3, "cvss_fp_weight": 5.2, "cvss_fn_weight": 148.4, "cvss_precision": 0.9261, "cvss_recall": 0.3056, "cvss_f3": 0.3275, "cvss_f3_score": 32.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 6, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3243, "f1": 0.4364, "f2": 0.3614, "f2_score": 36.1, "f3": 0.3419, "f3_score": 34.2, "tpr": 0.3243, "fpr": 0.6, "youden_j": -0.2757, "cvss_coverage": 1.0, "cvss_tp_weight": 72.9, "cvss_fp_weight": 31.3, "cvss_fn_weight": 140.8, "cvss_precision": 0.6998, "cvss_recall": 0.3411, "cvss_f3": 0.3596, "cvss_f3_score": 36.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 8, "fp": 0, "fn": 14, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 6, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.7568, "f1": 0.7887, "f2": 0.7692, "f2_score": 76.9, "f3": 0.7629, "f3_score": 76.3, "tpr": 0.7568, "fpr": 0.6, "youden_j": 0.1568, "cvss_coverage": 1.0, "cvss_tp_weight": 158.0, "cvss_fp_weight": 26.6, "cvss_fn_weight": 55.7, "cvss_precision": 0.8561, "cvss_recall": 0.7394, "cvss_f3": 0.7496, "cvss_f3_score": 75.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 19, "fp": 0, "fn": 3, "recall": 0.8636 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-037", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 7, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6677, "recall": 0.3604, "f1": 0.4674, "f2": 0.3966, "f2_score": 39.7, "f3": 0.3776, "f3_score": 37.8, "tpr": 0.3604, "fpr": 0.6445, "youden_j": -0.2841, "cvss_coverage": 1.0, "cvss_tp_weight": 80.5, "cvss_fp_weight": 33.2, "cvss_fn_weight": 133.2, "cvss_precision": 0.708, "cvss_recall": 0.3767, "cvss_f3": 0.3952, "cvss_f3_score": 39.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 1, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": "backend/app/main.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.4054, "f1": 0.5556, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4286, "f3_score": 42.9, "tpr": 0.4054, "fpr": 0.3333, "youden_j": 0.0721, "cvss_coverage": 1.0, "cvss_tp_weight": 92.8, "cvss_fp_weight": 1.0, "cvss_fn_weight": 120.9, "cvss_precision": 0.9893, "cvss_recall": 0.4343, "cvss_f3": 0.4601, "cvss_f3_score": 46.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 18, "fp": 7, "fn": 19, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7261, "recall": 0.4775, "f1": 0.5761, "f2": 0.5126, "f2_score": 51.2, "f3": 0.4944, "f3_score": 49.4, "tpr": 0.4775, "fpr": 0.6889, "youden_j": -0.2114, "cvss_coverage": 1.0, "cvss_tp_weight": 107.3, "cvss_fp_weight": 20.6, "cvss_fn_weight": 106.4, "cvss_precision": 0.8405, "cvss_recall": 0.5021, "cvss_f3": 0.5231, "cvss_f3_score": 52.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 1, "fn": 14, "precision": 0.8889, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 8, "fp": 1, "fn": 14, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 14, "fp": 6, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.3784, "f1": 0.4912, "f2": 0.4167, "f2_score": 41.7, "f3": 0.3966, "f3_score": 39.7, "tpr": 0.3784, "fpr": 0.6, "youden_j": -0.2216, "cvss_coverage": 1.0, "cvss_tp_weight": 83.5, "cvss_fp_weight": 26.6, "cvss_fn_weight": 130.2, "cvss_precision": 0.7587, "cvss_recall": 0.3907, "cvss_f3": 0.4107, "cvss_f3_score": 41.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3636 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 10, "fp": 0, "fn": 12, "recall": 0.4545 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 0, "fp": 0, "fn": 37, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 213.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 22, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-038", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-154", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 29, "fp": 49, "fn": 8, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3718, "recall": 0.7838, "f1": 0.5043, "f2": 0.6416, "f2_score": 64.2, "f3": 0.7056, "f3_score": 70.6, "tpr": 0.7838, "fpr": 0.9423, "youden_j": -0.1585, "cvss_coverage": 1.0, "cvss_tp_weight": 170.9, "cvss_fp_weight": 345.0, "cvss_fn_weight": 42.8, "cvss_precision": 0.3313, "cvss_recall": 0.7997, "cvss_f3": 0.7006, "cvss_f3_score": 70.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 1, "fn": 6, "precision": 0.9412, "recall": 0.7273 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 17, "fp": 1, "fn": 5, "recall": 0.7727 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 26, "fp": 16, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.7027, "f1": 0.6582, "f2": 0.6842, "f2_score": 68.4, "f3": 0.6933, "f3_score": 69.3, "tpr": 0.7027, "fpr": 0.8, "youden_j": -0.0973, "cvss_coverage": 1.0, "cvss_tp_weight": 159.1, "cvss_fp_weight": 106.5, "cvss_fn_weight": 54.6, "cvss_precision": 0.599, "cvss_recall": 0.7445, "cvss_f3": 0.7268, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 14, "fp": 0, "fn": 8, "recall": 0.6364 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 0, "fn": 35, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0541, "f1": 0.1026, "f2": 0.0667, "f2_score": 6.7, "f3": 0.0597, "f3_score": 6.0, "tpr": 0.0541, "fpr": 0.0, "youden_j": 0.0541, "cvss_coverage": 1.0, "cvss_tp_weight": 13.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 200.4, "cvss_precision": 1.0, "cvss_recall": 0.0622, "cvss_f3": 0.0687, "cvss_f3_score": 6.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.0455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-154", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 25, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4898, "recall": 0.6486, "f1": 0.5581, "f2": 0.6091, "f2_score": 60.9, "f3": 0.6283, "f3_score": 62.8, "tpr": 0.6486, "fpr": 0.8621, "youden_j": -0.2134, "cvss_coverage": 1.0, "cvss_tp_weight": 139.2, "cvss_fp_weight": 158.0, "cvss_fn_weight": 74.5, "cvss_precision": 0.4684, "cvss_recall": 0.6514, "cvss_f3": 0.6269, "cvss_f3_score": 62.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 13, "fp": 0, "fn": 9, "recall": 0.5909 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 29, "fp": 7, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8056, "recall": 0.7838, "f1": 0.7945, "f2": 0.788, "f2_score": 78.8, "f3": 0.7859, "f3_score": 78.6, "tpr": 0.7838, "fpr": 0.6364, "youden_j": 0.1474, "cvss_coverage": 1.0, "cvss_tp_weight": 166.4, "cvss_fp_weight": 51.0, "cvss_fn_weight": 47.3, "cvss_precision": 0.7654, "cvss_recall": 0.7787, "cvss_f3": 0.7773, "cvss_f3_score": 77.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8636 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 18, "fp": 0, "fn": 4, "recall": 0.8182 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-538", "file": "backend/app/loan_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 3, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8421, "recall": 0.4324, "f1": 0.5714, "f2": 0.479, "f2_score": 47.9, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4324, "fpr": 0.4286, "youden_j": 0.0039, "cvss_coverage": 1.0, "cvss_tp_weight": 100.4, "cvss_fp_weight": 13.0, "cvss_fn_weight": 113.3, "cvss_precision": 0.8854, "cvss_recall": 0.4698, "cvss_f3": 0.493, "cvss_f3_score": 49.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3182 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 8, "fp": 0, "fn": 14, "recall": 0.3636 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 26, "fp": 31, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4561, "recall": 0.7027, "f1": 0.5532, "f2": 0.6341, "f2_score": 63.4, "f3": 0.6667, "f3_score": 66.7, "tpr": 0.7027, "fpr": 0.8857, "youden_j": -0.183, "cvss_coverage": 1.0, "cvss_tp_weight": 152.2, "cvss_fp_weight": 198.5, "cvss_fn_weight": 61.5, "cvss_precision": 0.434, "cvss_recall": 0.7122, "cvss_f3": 0.6693, "cvss_f3_score": 66.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.6364 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 15, "fp": 0, "fn": 7, "recall": 0.6818 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 11, "fp": 3, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7932, "recall": 0.3063, "f1": 0.4415, "f2": 0.349, "f2_score": 34.9, "f3": 0.3263, "f3_score": 32.6, "tpr": 0.3063, "fpr": 0.4206, "youden_j": -0.1143, "cvss_coverage": 1.0, "cvss_tp_weight": 68.4, "cvss_fp_weight": 9.3, "cvss_fn_weight": 145.3, "cvss_precision": 0.8801, "cvss_recall": 0.3201, "cvss_f3": 0.3418, "cvss_f3_score": 34.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2273 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 4, "fp": 0, "fn": 18, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 15, "fp": 13, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5357, "recall": 0.4054, "f1": 0.4615, "f2": 0.4261, "f2_score": 42.6, "f3": 0.4155, "f3_score": 41.6, "tpr": 0.4054, "fpr": 0.8125, "youden_j": -0.4071, "cvss_coverage": 1.0, "cvss_tp_weight": 90.8, "cvss_fp_weight": 63.0, "cvss_fn_weight": 122.9, "cvss_precision": 0.5902, "cvss_recall": 0.4249, "cvss_f3": 0.4371, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 1, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-528", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-240", "file": "backend/app/loan_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-199", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-458", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": "backend/app/main.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-154", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 10, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.4054, "f1": 0.4839, "f2": 0.4335, "f2_score": 43.4, "f3": 0.419, "f3_score": 41.9, "tpr": 0.4054, "fpr": 0.7692, "youden_j": -0.3638, "cvss_coverage": 1.0, "cvss_tp_weight": 91.3, "cvss_fp_weight": 47.4, "cvss_fn_weight": 122.4, "cvss_precision": 0.6582, "cvss_recall": 0.4272, "cvss_f3": 0.4428, "cvss_f3_score": 44.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 1, "fn": 16, "precision": 0.8571, "recall": 0.2727 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 7, "fp": 1, "fn": 15, "recall": 0.3182 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-038", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-468", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-128", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-495", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-478", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" } ] }, "rowan": { "scanner": "rowan", "tp": 10, "fp": 22, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3125, "recall": 0.2703, "f1": 0.2899, "f2": 0.2778, "f2_score": 27.8, "f3": 0.274, "f3_score": 27.4, "tpr": 0.2703, "fpr": 0.8462, "youden_j": -0.5759, "cvss_coverage": 1.0, "cvss_tp_weight": 60.7, "cvss_fp_weight": 117.5, "cvss_fn_weight": 153.0, "cvss_precision": 0.3406, "cvss_recall": 0.284, "cvss_f3": 0.2888, "cvss_f3_score": 28.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.1364 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-486", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-322", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-517", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_workflow.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-038", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-154", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 7, "fn": 37, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6364, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 27.1, "cvss_fn_weight": 213.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 22, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-fintech-lending-fastapi/backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-038", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-039", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-154", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-292", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-507", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-548", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 4, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.1622, "f1": 0.2553, "f2": 0.1899, "f2_score": 19.0, "f3": 0.1749, "f3_score": 17.5, "tpr": 0.1622, "fpr": 0.5, "youden_j": -0.3378, "cvss_coverage": 1.0, "cvss_tp_weight": 33.0, "cvss_fp_weight": 25.1, "cvss_fn_weight": 180.7, "cvss_precision": 0.5676, "cvss_recall": 0.1544, "cvss_f3": 0.1665, "cvss_f3_score": 16.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 22, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 4, "fp": 0, "fn": 18, "recall": 0.1818 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-039", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-154", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-292", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-507", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-548", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-038", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-128", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-199", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-240", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-322", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-458", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-468", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-478", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-486", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-495", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-517", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-528", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-538", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-016", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-017", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-fintech-lending-fastapi-enrich-018", "file": null, "cwe": "CWE-22" } ] } }, "vc-codex-seeded-v2-healthcare-clinic-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 25, "fp": 9, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7353, "recall": 0.6098, "f1": 0.6667, "f2": 0.6313, "f2_score": 63.1, "f3": 0.6203, "f3_score": 62.0, "tpr": 0.6098, "fpr": 0.6923, "youden_j": -0.0826, "cvss_coverage": 1.0, "cvss_tp_weight": 145.9, "cvss_fp_weight": 47.9, "cvss_fn_weight": 93.8, "cvss_precision": 0.7527, "cvss_recall": 0.6087, "cvss_f3": 0.6206, "cvss_f3_score": 62.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5652 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "medium": { "tp": 13, "fp": 0, "fn": 10, "recall": 0.5652 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 18, "fp": 9, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.439, "f1": 0.5294, "f2": 0.4712, "f2_score": 47.1, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.439, "fpr": 0.6923, "youden_j": -0.2533, "cvss_coverage": 1.0, "cvss_tp_weight": 105.9, "cvss_fp_weight": 38.3, "cvss_fn_weight": 133.8, "cvss_precision": 0.7345, "cvss_recall": 0.4418, "cvss_f3": 0.4601, "cvss_f3_score": 46.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3913 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 2, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.3659, "f1": 0.5172, "f2": 0.4144, "f2_score": 41.4, "f3": 0.3886, "f3_score": 38.9, "tpr": 0.3659, "fpr": 0.3333, "youden_j": 0.0325, "cvss_coverage": 1.0, "cvss_tp_weight": 84.5, "cvss_fp_weight": 10.7, "cvss_fn_weight": 155.2, "cvss_precision": 0.888, "cvss_recall": 0.3525, "cvss_f3": 0.3751, "cvss_f3_score": 37.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.2174 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 3, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.3415, "f1": 0.4828, "f2": 0.3867, "f2_score": 38.7, "f3": 0.3627, "f3_score": 36.3, "tpr": 0.3415, "fpr": 0.4286, "youden_j": -0.0871, "cvss_coverage": 1.0, "cvss_tp_weight": 79.5, "cvss_fp_weight": 11.2, "cvss_fn_weight": 160.2, "cvss_precision": 0.877, "cvss_recall": 0.3317, "cvss_f3": 0.3537, "cvss_f3_score": 35.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 15, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.4878, "f1": 0.5263, "f2": 0.5025, "f2_score": 50.3, "f3": 0.495, "f3_score": 49.5, "tpr": 0.4878, "fpr": 0.7895, "youden_j": -0.3017, "cvss_coverage": 1.0, "cvss_tp_weight": 116.7, "cvss_fp_weight": 70.2, "cvss_fn_weight": 123.0, "cvss_precision": 0.6242, "cvss_recall": 0.4869, "cvss_f3": 0.4978, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3913 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9697, "recall": 0.2195, "f1": 0.3562, "f2": 0.2593, "f2_score": 25.9, "f3": 0.2378, "f3_score": 23.8, "tpr": 0.2195, "fpr": 0.0667, "youden_j": 0.1528, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 1.8, "cvss_fn_weight": 184.6, "cvss_precision": 0.9728, "cvss_recall": 0.2299, "cvss_f3": 0.2488, "cvss_f3_score": 24.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0435 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "medium": { "tp": 2, "fp": 0, "fn": 21, "recall": 0.087 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 9, "fp": 0, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2195, "f1": 0.36, "f2": 0.2601, "f2_score": 26.0, "f3": 0.2381, "f3_score": 23.8, "tpr": 0.2195, "fpr": 0.0, "youden_j": 0.2195, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 184.6, "cvss_precision": 1.0, "cvss_recall": 0.2299, "cvss_f3": 0.2491, "cvss_f3_score": 24.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.1304 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "medium": { "tp": 3, "fp": 0, "fn": 20, "recall": 0.1304 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8869, "recall": 0.3171, "f1": 0.4664, "f2": 0.3636, "f2_score": 36.4, "f3": 0.3387, "f3_score": 33.9, "tpr": 0.3171, "fpr": 0.2762, "youden_j": 0.0409, "cvss_coverage": 1.0, "cvss_tp_weight": 76.8, "cvss_fp_weight": 5.6, "cvss_fn_weight": 162.9, "cvss_precision": 0.9306, "cvss_recall": 0.3203, "cvss_f3": 0.3426, "cvss_f3_score": 34.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.2174 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 5, "fp": 0, "fn": 18, "recall": 0.2174 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/tests.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 17, "fp": 7, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.4146, "f1": 0.5257, "f2": 0.4528, "f2_score": 45.3, "f3": 0.4328, "f3_score": 43.3, "tpr": 0.4146, "fpr": 0.616, "youden_j": -0.2013, "cvss_coverage": 1.0, "cvss_tp_weight": 97.8, "cvss_fp_weight": 29.1, "cvss_fn_weight": 141.9, "cvss_precision": 0.7719, "cvss_recall": 0.408, "cvss_f3": 0.4281, "cvss_f3_score": 42.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3043 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 10, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6568, "recall": 0.4227, "f1": 0.509, "f2": 0.4528, "f2_score": 45.3, "f3": 0.4372, "f3_score": 43.7, "tpr": 0.4227, "fpr": 0.6714, "youden_j": -0.2487, "cvss_coverage": 1.0, "cvss_tp_weight": 99.6, "cvss_fp_weight": 25.9, "cvss_fn_weight": 140.1, "cvss_precision": 0.8051, "cvss_recall": 0.4156, "cvss_f3": 0.4363, "cvss_f3_score": 43.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.3478 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 15, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6053, "recall": 0.561, "f1": 0.5823, "f2": 0.5693, "f2_score": 56.9, "f3": 0.5651, "f3_score": 56.5, "tpr": 0.561, "fpr": 0.7895, "youden_j": -0.2285, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 55.8, "cvss_fn_weight": 104.4, "cvss_precision": 0.7081, "cvss_recall": 0.5645, "cvss_f3": 0.5761, "cvss_f3_score": 57.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.4783 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "medium": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 19, "fp": 7, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7272, "recall": 0.4553, "f1": 0.5599, "f2": 0.4921, "f2_score": 49.2, "f3": 0.473, "f3_score": 47.3, "tpr": 0.4553, "fpr": 0.6344, "youden_j": -0.179, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 27.6, "cvss_fn_weight": 129.0, "cvss_precision": 0.7998, "cvss_recall": 0.4617, "cvss_f3": 0.482, "cvss_f3_score": 48.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3913 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 4, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.3902, "f1": 0.5246, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4113, "f3_score": 41.1, "tpr": 0.3902, "fpr": 0.5, "youden_j": -0.1098, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 16.5, "cvss_fn_weight": 144.0, "cvss_precision": 0.8531, "cvss_recall": 0.3992, "cvss_f3": 0.4217, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 41, "fp": 1, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9762, "recall": 1.0, "f1": 0.988, "f2": 0.9951, "f2_score": 99.5, "f3": 0.9976, "f3_score": 99.8, "tpr": 1.0, "fpr": 0.2, "youden_j": 0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 239.7, "cvss_fp_weight": 5.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.9783, "cvss_recall": 1.0, "cvss_f3": 0.9978, "cvss_f3_score": 99.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 23, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_project/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": "clinic_project/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": "clinic/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": "clinic/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 16, "fp": 8, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3902, "f1": 0.4923, "f2": 0.4255, "f2_score": 42.6, "f3": 0.4071, "f3_score": 40.7, "tpr": 0.3902, "fpr": 0.6667, "youden_j": -0.2764, "cvss_coverage": 1.0, "cvss_tp_weight": 91.9, "cvss_fp_weight": 33.0, "cvss_fn_weight": 147.8, "cvss_precision": 0.736, "cvss_recall": 0.3834, "cvss_f3": 0.4027, "cvss_f3_score": 40.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 17, "fp": 5, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.4146, "f1": 0.5397, "f2": 0.457, "f2_score": 45.7, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4146, "fpr": 0.5556, "youden_j": -0.1409, "cvss_coverage": 1.0, "cvss_tp_weight": 103.2, "cvss_fp_weight": 26.6, "cvss_fn_weight": 136.5, "cvss_precision": 0.7949, "cvss_recall": 0.4305, "cvss_f3": 0.4512, "cvss_f3_score": 45.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.3043 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/forms.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/appointment_detail.html", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": "clinic/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 41, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 239.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 23, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 23, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_project/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": "clinic_project/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": "clinic/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": "clinic/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 4, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.752, "recall": 0.2927, "f1": 0.4212, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3117, "f3_score": 31.2, "tpr": 0.2927, "fpr": 0.4947, "youden_j": -0.202, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 10.0, "cvss_fn_weight": 170.1, "cvss_precision": 0.878, "cvss_recall": 0.2905, "cvss_f3": 0.3113, "cvss_f3_score": 31.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.1739 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 4, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7845, "recall": 0.3415, "f1": 0.4743, "f2": 0.3844, "f2_score": 38.5, "f3": 0.3616, "f3_score": 36.2, "tpr": 0.3415, "fpr": 0.4815, "youden_j": -0.14, "cvss_coverage": 1.0, "cvss_tp_weight": 81.1, "cvss_fp_weight": 6.8, "cvss_fn_weight": 158.6, "cvss_precision": 0.9276, "cvss_recall": 0.3382, "cvss_f3": 0.361, "cvss_f3_score": 36.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 5, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7676, "recall": 0.3984, "f1": 0.5241, "f2": 0.4406, "f2_score": 44.1, "f3": 0.4184, "f3_score": 41.9, "tpr": 0.3984, "fpr": 0.5402, "youden_j": -0.1418, "cvss_coverage": 1.0, "cvss_tp_weight": 95.6, "cvss_fp_weight": 9.0, "cvss_fn_weight": 144.1, "cvss_precision": 0.9137, "cvss_recall": 0.3987, "cvss_f3": 0.4225, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.2609 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 12, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.5122, "f1": 0.5676, "f2": 0.533, "f2_score": 53.3, "f3": 0.5224, "f3_score": 52.2, "tpr": 0.5122, "fpr": 0.75, "youden_j": -0.2378, "cvss_coverage": 1.0, "cvss_tp_weight": 119.3, "cvss_fp_weight": 39.8, "cvss_fn_weight": 120.4, "cvss_precision": 0.7499, "cvss_recall": 0.4977, "cvss_f3": 0.515, "cvss_f3_score": 51.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.4348 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 24, "fp": 10, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.5854, "f1": 0.64, "f2": 0.6061, "f2_score": 60.6, "f3": 0.5955, "f3_score": 59.6, "tpr": 0.5854, "fpr": 0.7143, "youden_j": -0.1289, "cvss_coverage": 1.0, "cvss_tp_weight": 144.0, "cvss_fp_weight": 71.5, "cvss_fn_weight": 95.7, "cvss_precision": 0.6682, "cvss_recall": 0.6008, "cvss_f3": 0.6069, "cvss_f3_score": 60.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.5217 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 36, "fp": 34, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5143, "recall": 0.878, "f1": 0.6486, "f2": 0.7692, "f2_score": 76.9, "f3": 0.82, "f3_score": 82.0, "tpr": 0.878, "fpr": 0.8947, "youden_j": -0.0167, "cvss_coverage": 1.0, "cvss_tp_weight": 209.2, "cvss_fp_weight": 222.0, "cvss_fn_weight": 30.5, "cvss_precision": 0.4852, "cvss_recall": 0.8728, "cvss_f3": 0.8082, "cvss_f3_score": 80.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8696 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 20, "fp": 0, "fn": 3, "recall": 0.8696 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_project/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-471" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": "clinic/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 35, "fp": 19, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6481, "recall": 0.8537, "f1": 0.7368, "f2": 0.8028, "f2_score": 80.3, "f3": 0.8274, "f3_score": 82.7, "tpr": 0.8537, "fpr": 0.8261, "youden_j": 0.0276, "cvss_coverage": 1.0, "cvss_tp_weight": 207.4, "cvss_fp_weight": 125.5, "cvss_fn_weight": 32.3, "cvss_precision": 0.623, "cvss_recall": 0.8652, "cvss_f3": 0.8329, "cvss_f3_score": 83.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8261 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 1, "recall": 0.9375 }, "medium": { "tp": 18, "fp": 0, "fn": 5, "recall": 0.7826 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-471" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-472" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_project/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-471" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "templates/clinic/appointment_detail.html", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 1, "fn": 37, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.0976, "f1": 0.1739, "f2": 0.1183, "f2_score": 11.8, "f3": 0.107, "f3_score": 10.7, "tpr": 0.0976, "fpr": 0.2, "youden_j": -0.1024, "cvss_coverage": 1.0, "cvss_tp_weight": 25.7, "cvss_fp_weight": 8.0, "cvss_fn_weight": 214.0, "cvss_precision": 0.7626, "cvss_recall": 0.1072, "cvss_f3": 0.1173, "cvss_f3_score": 11.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 22, "precision": 1.0, "recall": 0.0435 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "medium": { "tp": 1, "fp": 0, "fn": 22, "recall": 0.0435 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/forms.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-490", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-508", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-520", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 30, "fp": 30, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7317, "f1": 0.5941, "f2": 0.6696, "f2_score": 67.0, "f3": 0.6993, "f3_score": 69.9, "tpr": 0.7317, "fpr": 0.8824, "youden_j": -0.1506, "cvss_coverage": 1.0, "cvss_tp_weight": 169.5, "cvss_fp_weight": 200.0, "cvss_fn_weight": 70.2, "cvss_precision": 0.4587, "cvss_recall": 0.7071, "cvss_f3": 0.6708, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7826 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "medium": { "tp": 18, "fp": 0, "fn": 5, "recall": 0.7826 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 34, "fp": 5, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8718, "recall": 0.8293, "f1": 0.85, "f2": 0.8374, "f2_score": 83.7, "f3": 0.8333, "f3_score": 83.3, "tpr": 0.8293, "fpr": 0.5556, "youden_j": 0.2737, "cvss_coverage": 1.0, "cvss_tp_weight": 205.8, "cvss_fp_weight": 37.5, "cvss_fn_weight": 33.9, "cvss_precision": 0.8459, "cvss_recall": 0.8586, "cvss_f3": 0.8573, "cvss_f3_score": 85.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7826 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 1, "recall": 0.9375 }, "medium": { "tp": 17, "fp": 0, "fn": 6, "recall": 0.7391 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-339", "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": "clinic/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": "clinic/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": "clinic_project/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": "clinic_project/urls.py", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 31, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4038, "recall": 0.5122, "f1": 0.4516, "f2": 0.4861, "f2_score": 48.6, "f3": 0.4988, "f3_score": 49.9, "tpr": 0.5122, "fpr": 0.8857, "youden_j": -0.3735, "cvss_coverage": 1.0, "cvss_tp_weight": 124.1, "cvss_fp_weight": 191.0, "cvss_fn_weight": 115.6, "cvss_precision": 0.3938, "cvss_recall": 0.5177, "cvss_f3": 0.5019, "cvss_f3_score": 50.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.4348 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": "clinic/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": "clinic/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 32, "fp": 54, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3721, "recall": 0.7805, "f1": 0.5039, "f2": 0.64, "f2_score": 64.0, "f3": 0.7033, "f3_score": 70.3, "tpr": 0.7805, "fpr": 0.931, "youden_j": -0.1505, "cvss_coverage": 1.0, "cvss_tp_weight": 181.9, "cvss_fp_weight": 328.5, "cvss_fn_weight": 57.8, "cvss_precision": 0.3564, "cvss_recall": 0.7589, "cvss_f3": 0.6819, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.8261 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "medium": { "tp": 20, "fp": 0, "fn": 3, "recall": 0.8696 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": "clinic/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/forms.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": "clinic/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/models.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": "clinic/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": "clinic/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": "clinic/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-042", "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-129", "file": "clinic_project/patient_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-459", "file": "clinic_project/patient_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-529", "file": "clinic_project/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_project/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_project/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": "clinic_project/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 12, "fp": 4, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2927, "f1": 0.4211, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3117, "f3_score": 31.2, "tpr": 0.2927, "fpr": 0.5, "youden_j": -0.2073, "cvss_coverage": 1.0, "cvss_tp_weight": 73.8, "cvss_fp_weight": 11.7, "cvss_fn_weight": 165.9, "cvss_precision": 0.8636, "cvss_recall": 0.3079, "cvss_f3": 0.3291, "cvss_f3_score": 32.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.2174 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-041", "file": "clinic_project/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 5, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.2927, "f1": 0.4138, "f2": 0.3315, "f2_score": 33.1, "f3": 0.3109, "f3_score": 31.1, "tpr": 0.2927, "fpr": 0.5556, "youden_j": -0.2629, "cvss_coverage": 1.0, "cvss_tp_weight": 68.8, "cvss_fp_weight": 26.6, "cvss_fn_weight": 170.9, "cvss_precision": 0.7209, "cvss_recall": 0.287, "cvss_f3": 0.3054, "cvss_f3_score": 30.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.2174 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-496", "file": "clinic_project/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-539", "file": "clinic_project/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-155", "file": "clinic_project/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-469", "file": "clinic_project/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/clinic/integrations.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-479", "file": "clinic_project/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_project/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-490", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 17, "fn": 41, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8095, "youden_j": -0.8095, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 80.9, "cvss_fn_weight": 239.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 23, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "seed_clinic.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-155", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-256", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-490", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-508", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-520", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 17, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.32, "recall": 0.1951, "f1": 0.2424, "f2": 0.2116, "f2_score": 21.2, "f3": 0.203, "f3_score": 20.3, "tpr": 0.1951, "fpr": 0.8095, "youden_j": -0.6144, "cvss_coverage": 1.0, "cvss_tp_weight": 47.6, "cvss_fp_weight": 44.0, "cvss_fn_weight": 192.1, "cvss_precision": 0.5197, "cvss_recall": 0.1986, "cvss_f3": 0.2117, "cvss_f3_score": 21.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 21, "precision": 1.0, "recall": 0.087 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "medium": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-520", "file": "clinic_project/patient_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": "clinic/views.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-293", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-490", "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-155", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 11, "fn": 41, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7333, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 58.6, "cvss_fn_weight": 239.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 23, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-healthcare-clinic-django/clinic_project/patient_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-155", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-216", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-256", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-490", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-508", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-520", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-549", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 43, "fn": 36, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1042, "recall": 0.122, "f1": 0.1124, "f2": 0.1179, "f2_score": 11.8, "f3": 0.1199, "f3_score": 12.0, "tpr": 0.122, "fpr": 0.9149, "youden_j": -0.7929, "cvss_coverage": 1.0, "cvss_tp_weight": 29.5, "cvss_fp_weight": 233.2, "cvss_fn_weight": 210.2, "cvss_precision": 0.1123, "cvss_recall": 0.1231, "cvss_f3": 0.1219, "cvss_f3_score": 12.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 23, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 15, "recall": 0.0625 }, "medium": { "tp": 3, "fp": 0, "fn": 20, "recall": 0.1304 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/management/commands/seed_clinic.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-040", "file": "clinic_project/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-216", "file": "clinic_project/patient_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-256", "file": "clinic_project/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-508", "file": "clinic_project/patient_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-549", "file": "clinic_project/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/patient_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_project/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-041", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-042", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-129", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-155", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-293", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-339", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-459", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-469", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-479", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-490", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-496", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-520", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-529", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-539", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-012", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-013", "file": null, "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-017", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-020", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-healthcare-clinic-django-enrich-022", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-seeded-v2-hr-payroll-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 23, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7931, "recall": 0.5897, "f1": 0.6765, "f2": 0.6216, "f2_score": 62.2, "f3": 0.6053, "f3_score": 60.5, "tpr": 0.5897, "fpr": 0.6, "youden_j": -0.0103, "cvss_coverage": 1.0, "cvss_tp_weight": 134.3, "cvss_fp_weight": 31.4, "cvss_fn_weight": 90.5, "cvss_precision": 0.8107, "cvss_recall": 0.5974, "cvss_f3": 0.6136, "cvss_f3_score": 61.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-497", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 21, "fp": 6, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.5385, "f1": 0.6364, "f2": 0.5738, "f2_score": 57.4, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5385, "fpr": 0.6, "youden_j": -0.0615, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 21.9, "cvss_fn_weight": 103.3, "cvss_precision": 0.8472, "cvss_recall": 0.5405, "cvss_f3": 0.5608, "cvss_f3_score": 56.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 1, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 0.4359, "f1": 0.5965, "f2": 0.4885, "f2_score": 48.9, "f3": 0.4607, "f3_score": 46.1, "tpr": 0.4359, "fpr": 0.2, "youden_j": 0.2359, "cvss_coverage": 1.0, "cvss_tp_weight": 95.6, "cvss_fp_weight": 0.5, "cvss_fn_weight": 129.2, "cvss_precision": 0.9948, "cvss_recall": 0.4253, "cvss_f3": 0.4511, "cvss_f3_score": 45.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 6, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.4359, "f1": 0.5484, "f2": 0.4749, "f2_score": 47.5, "f3": 0.4545, "f3_score": 45.5, "tpr": 0.4359, "fpr": 0.6, "youden_j": -0.1641, "cvss_coverage": 1.0, "cvss_tp_weight": 100.1, "cvss_fp_weight": 26.6, "cvss_fn_weight": 124.7, "cvss_precision": 0.7898, "cvss_recall": 0.4453, "cvss_f3": 0.4656, "cvss_f3_score": 46.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 32, "fp": 20, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.8205, "f1": 0.7033, "f2": 0.7692, "f2_score": 76.9, "f3": 0.794, "f3_score": 79.4, "tpr": 0.8205, "fpr": 0.8333, "youden_j": -0.0128, "cvss_coverage": 1.0, "cvss_tp_weight": 188.8, "cvss_fp_weight": 90.4, "cvss_fn_weight": 36.0, "cvss_precision": 0.6763, "cvss_recall": 0.8399, "cvss_f3": 0.82, "cvss_f3_score": 82.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 4, "recall": 0.8095 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 12, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3205, "f1": 0.4853, "f2": 0.3709, "f2_score": 37.1, "f3": 0.3438, "f3_score": 34.4, "tpr": 0.3205, "fpr": 0.0, "youden_j": 0.3205, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 0.0, "cvss_fn_weight": 150.3, "cvss_precision": 1.0, "cvss_recall": 0.3311, "cvss_f3": 0.3549, "cvss_f3_score": 35.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 11, "fp": 1, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9167, "recall": 0.2821, "f1": 0.4314, "f2": 0.3274, "f2_score": 32.7, "f3": 0.303, "f3_score": 30.3, "tpr": 0.2821, "fpr": 0.2, "youden_j": 0.0821, "cvss_coverage": 1.0, "cvss_tp_weight": 71.2, "cvss_fp_weight": 0.5, "cvss_fn_weight": 153.6, "cvss_precision": 0.993, "cvss_recall": 0.3167, "cvss_f3": 0.3399, "cvss_f3_score": 34.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 19, "recall": 0.0952 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 16, "fp": 4, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8074, "recall": 0.4017, "f1": 0.5362, "f2": 0.4465, "f2_score": 44.7, "f3": 0.4229, "f3_score": 42.3, "tpr": 0.4017, "fpr": 0.4709, "youden_j": -0.0692, "cvss_coverage": 1.0, "cvss_tp_weight": 88.2, "cvss_fp_weight": 16.0, "cvss_fn_weight": 136.6, "cvss_precision": 0.842, "cvss_recall": 0.3922, "cvss_f3": 0.4142, "cvss_f3_score": 41.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 17, "fp": 7, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7038, "recall": 0.4444, "f1": 0.5445, "f2": 0.4797, "f2_score": 48.0, "f3": 0.4614, "f3_score": 46.1, "tpr": 0.4444, "fpr": 0.6445, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 97.6, "cvss_fp_weight": 30.5, "cvss_fn_weight": 127.2, "cvss_precision": 0.7625, "cvss_recall": 0.434, "cvss_f3": 0.4535, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 21, "fp": 12, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6523, "recall": 0.5299, "f1": 0.5808, "f2": 0.5484, "f2_score": 54.9, "f3": 0.5389, "f3_score": 53.9, "tpr": 0.5299, "fpr": 0.7106, "youden_j": -0.1806, "cvss_coverage": 1.0, "cvss_tp_weight": 118.9, "cvss_fp_weight": 35.9, "cvss_fn_weight": 105.9, "cvss_precision": 0.7829, "cvss_recall": 0.5289, "cvss_f3": 0.546, "cvss_f3_score": 54.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 11, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6765, "recall": 0.5897, "f1": 0.6301, "f2": 0.6053, "f2_score": 60.5, "f3": 0.5974, "f3_score": 59.7, "tpr": 0.5897, "fpr": 0.7333, "youden_j": -0.1436, "cvss_coverage": 1.0, "cvss_tp_weight": 130.4, "cvss_fp_weight": 33.9, "cvss_fn_weight": 94.4, "cvss_precision": 0.7938, "cvss_recall": 0.5801, "cvss_f3": 0.5961, "cvss_f3_score": 59.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 10, "recall": 0.5238 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 21, "fp": 6, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7691, "recall": 0.5384, "f1": 0.6326, "f2": 0.5724, "f2_score": 57.2, "f3": 0.5549, "f3_score": 55.5, "tpr": 0.5384, "fpr": 0.6095, "youden_j": -0.0709, "cvss_coverage": 1.0, "cvss_tp_weight": 120.8, "cvss_fp_weight": 20.5, "cvss_fn_weight": 104.0, "cvss_precision": 0.856, "cvss_recall": 0.5375, "cvss_f3": 0.5581, "cvss_f3_score": 55.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-839" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 17, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.4359, "f1": 0.5862, "f2": 0.4857, "f2_score": 48.6, "f3": 0.4595, "f3_score": 45.9, "tpr": 0.4359, "fpr": 0.3333, "youden_j": 0.1026, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 5.7, "cvss_fn_weight": 122.8, "cvss_precision": 0.9468, "cvss_recall": 0.4537, "cvss_f3": 0.4787, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 39, "fp": 3, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9286, "recall": 1.0, "f1": 0.963, "f2": 0.9848, "f2_score": 98.5, "f3": 0.9924, "f3_score": 99.2, "tpr": 1.0, "fpr": 0.4286, "youden_j": 0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 224.8, "cvss_fp_weight": 11.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.9535, "cvss_recall": 1.0, "cvss_f3": 0.9952, "cvss_f3_score": 99.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 21, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-460", "file": "config/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": "payroll/forms.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 17, "fp": 3, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.4359, "f1": 0.5763, "f2": 0.483, "f2_score": 48.3, "f3": 0.4582, "f3_score": 45.8, "tpr": 0.4359, "fpr": 0.4286, "youden_j": 0.0073, "cvss_coverage": 1.0, "cvss_tp_weight": 101.2, "cvss_fp_weight": 15.7, "cvss_fn_weight": 123.6, "cvss_precision": 0.8658, "cvss_recall": 0.4502, "cvss_f3": 0.4729, "cvss_f3_score": 47.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 17, "fp": 5, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.4359, "f1": 0.5574, "f2": 0.4775, "f2_score": 47.8, "f3": 0.4558, "f3_score": 45.6, "tpr": 0.4359, "fpr": 0.5556, "youden_j": -0.1197, "cvss_coverage": 1.0, "cvss_tp_weight": 105.6, "cvss_fp_weight": 26.1, "cvss_fn_weight": 119.2, "cvss_precision": 0.8016, "cvss_recall": 0.4698, "cvss_f3": 0.49, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-550", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 37, "fp": 2, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9487, "recall": 0.9487, "f1": 0.9487, "f2": 0.9487, "f2_score": 94.9, "f3": 0.9487, "f3_score": 94.9, "tpr": 0.9487, "fpr": 0.3333, "youden_j": 0.6154, "cvss_coverage": 1.0, "cvss_tp_weight": 210.1, "cvss_fp_weight": 10.5, "cvss_fn_weight": 14.7, "cvss_precision": 0.9526, "cvss_recall": 0.9346, "cvss_f3": 0.9364, "cvss_f3_score": 93.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 21, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-460", "file": "config/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": "payroll/forms.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 15, "fp": 3, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8529, "recall": 0.3846, "f1": 0.528, "f2": 0.4313, "f2_score": 43.1, "f3": 0.4066, "f3_score": 40.7, "tpr": 0.3846, "fpr": 0.3889, "youden_j": -0.0043, "cvss_coverage": 1.0, "cvss_tp_weight": 87.3, "cvss_fp_weight": 10.8, "cvss_fn_weight": 137.5, "cvss_precision": 0.8896, "cvss_recall": 0.3882, "cvss_f3": 0.4113, "cvss_f3_score": 41.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 18, "fp": 3, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.4615, "f1": 0.6, "f2": 0.5085, "f2_score": 50.8, "f3": 0.4839, "f3_score": 48.4, "tpr": 0.4615, "fpr": 0.4286, "youden_j": 0.033, "cvss_coverage": 1.0, "cvss_tp_weight": 105.5, "cvss_fp_weight": 1.5, "cvss_fn_weight": 119.3, "cvss_precision": 0.986, "cvss_recall": 0.4693, "cvss_f3": 0.4953, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 20, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8436, "recall": 0.5043, "f1": 0.6312, "f2": 0.5484, "f2_score": 54.9, "f3": 0.5254, "f3_score": 52.5, "tpr": 0.5043, "fpr": 0.463, "youden_j": 0.0413, "cvss_coverage": 1.0, "cvss_tp_weight": 116.2, "cvss_fp_weight": 6.6, "cvss_fn_weight": 108.6, "cvss_precision": 0.9467, "cvss_recall": 0.5169, "cvss_f3": 0.5415, "cvss_f3_score": 54.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.84, "recall": 0.5385, "f1": 0.6562, "f2": 0.5801, "f2_score": 58.0, "f3": 0.5585, "f3_score": 55.9, "tpr": 0.5385, "fpr": 0.5, "youden_j": 0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 121.0, "cvss_fp_weight": 6.7, "cvss_fn_weight": 103.8, "cvss_precision": 0.9473, "cvss_recall": 0.5383, "cvss_f3": 0.5625, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 23, "fp": 8, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7419, "recall": 0.5897, "f1": 0.6571, "f2": 0.615, "f2_score": 61.5, "f3": 0.6021, "f3_score": 60.2, "tpr": 0.5897, "fpr": 0.6667, "youden_j": -0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 134.9, "cvss_fp_weight": 45.5, "cvss_fn_weight": 89.9, "cvss_precision": 0.7478, "cvss_recall": 0.6001, "cvss_f3": 0.6122, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 33, "fp": 28, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.541, "recall": 0.8462, "f1": 0.66, "f2": 0.7604, "f2_score": 76.0, "f3": 0.801, "f3_score": 80.1, "tpr": 0.8462, "fpr": 0.875, "youden_j": -0.0288, "cvss_coverage": 1.0, "cvss_tp_weight": 193.5, "cvss_fp_weight": 185.5, "cvss_fn_weight": 31.3, "cvss_precision": 0.5106, "cvss_recall": 0.8608, "cvss_f3": 0.8055, "cvss_f3_score": 80.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7222 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 4, "recall": 0.8095 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-799" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 31, "fp": 34, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4769, "recall": 0.7949, "f1": 0.5962, "f2": 0.7014, "f2_score": 70.1, "f3": 0.7452, "f3_score": 74.5, "tpr": 0.7949, "fpr": 0.8947, "youden_j": -0.0999, "cvss_coverage": 1.0, "cvss_tp_weight": 185.9, "cvss_fp_weight": 209.5, "cvss_fn_weight": 38.9, "cvss_precision": 0.4702, "cvss_recall": 0.827, "cvss_f3": 0.7686, "cvss_f3_score": 76.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 5, "recall": 0.7619 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-524" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 5, "fp": 2, "fn": 34, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.1282, "f1": 0.2174, "f2": 0.1534, "f2_score": 15.3, "f3": 0.1397, "f3_score": 14.0, "tpr": 0.1282, "fpr": 0.3333, "youden_j": -0.2051, "cvss_coverage": 1.0, "cvss_tp_weight": 33.8, "cvss_fp_weight": 11.0, "cvss_fn_weight": 191.0, "cvss_precision": 0.7545, "cvss_recall": 0.1504, "cvss_f3": 0.1634, "cvss_f3_score": 16.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 21, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-045", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-355", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-497", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-521", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-540", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-550", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 26, "fp": 28, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4815, "recall": 0.6667, "f1": 0.5591, "f2": 0.619, "f2_score": 61.9, "f3": 0.642, "f3_score": 64.2, "tpr": 0.6667, "fpr": 0.875, "youden_j": -0.2083, "cvss_coverage": 1.0, "cvss_tp_weight": 149.2, "cvss_fp_weight": 173.0, "cvss_fn_weight": 75.6, "cvss_precision": 0.4631, "cvss_recall": 0.6637, "cvss_f3": 0.6361, "cvss_f3_score": 63.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 32, "fp": 5, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8649, "recall": 0.8205, "f1": 0.8421, "f2": 0.829, "f2_score": 82.9, "f3": 0.8247, "f3_score": 82.5, "tpr": 0.8205, "fpr": 0.5556, "youden_j": 0.265, "cvss_coverage": 1.0, "cvss_tp_weight": 186.9, "cvss_fp_weight": 37.5, "cvss_fn_weight": 37.9, "cvss_precision": 0.8329, "cvss_recall": 0.8314, "cvss_f3": 0.8316, "cvss_f3_score": 83.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 5, "recall": 0.7619 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-130", "file": "config/payroll_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-460", "file": "config/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/templates/payroll/employee_detail.html", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": "payroll/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 24, "fp": 20, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.6154, "f1": 0.5783, "f2": 0.6, "f2_score": 60.0, "f3": 0.6076, "f3_score": 60.8, "tpr": 0.6154, "fpr": 0.8333, "youden_j": -0.2179, "cvss_coverage": 1.0, "cvss_tp_weight": 146.3, "cvss_fp_weight": 121.5, "cvss_fn_weight": 78.5, "cvss_precision": 0.5463, "cvss_recall": 0.6508, "cvss_f3": 0.6386, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 10, "recall": 0.5238 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": "config/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": "payroll/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": "payroll/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-550", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 26, "fp": 35, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4262, "recall": 0.6667, "f1": 0.52, "f2": 0.5991, "f2_score": 59.9, "f3": 0.6311, "f3_score": 63.1, "tpr": 0.6667, "fpr": 0.8974, "youden_j": -0.2308, "cvss_coverage": 1.0, "cvss_tp_weight": 149.2, "cvss_fp_weight": 216.5, "cvss_fn_weight": 75.6, "cvss_precision": 0.408, "cvss_recall": 0.6637, "cvss_f3": 0.6246, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-530", "file": "config/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": "config/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/integrations.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": "payroll/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": "payroll/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 11, "fp": 3, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 0.2821, "f1": 0.4151, "f2": 0.3235, "f2_score": 32.4, "f3": 0.3014, "f3_score": 30.1, "tpr": 0.2821, "fpr": 0.4643, "youden_j": -0.1822, "cvss_coverage": 1.0, "cvss_tp_weight": 63.9, "cvss_fp_weight": 11.0, "cvss_fn_weight": 160.9, "cvss_precision": 0.8536, "cvss_recall": 0.2843, "cvss_f3": 0.3045, "cvss_f3_score": 30.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 1, "fn": 16, "recall": 0.2381 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": "config/payroll_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-540", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 16, "fp": 8, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4103, "f1": 0.5079, "f2": 0.4444, "f2_score": 44.4, "f3": 0.4267, "f3_score": 42.7, "tpr": 0.4103, "fpr": 0.6667, "youden_j": -0.2564, "cvss_coverage": 1.0, "cvss_tp_weight": 92.0, "cvss_fp_weight": 22.9, "cvss_fn_weight": 132.8, "cvss_precision": 0.8006, "cvss_recall": 0.4093, "cvss_f3": 0.4303, "cvss_f3_score": 43.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": "config/urls.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/authz.py", "cwe": "CWE-476" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/forms.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/payroll/document_center.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/templates/registration/login.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-550", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 16, "fp": 2, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.4103, "f1": 0.5614, "f2": 0.4598, "f2_score": 46.0, "f3": 0.4336, "f3_score": 43.4, "tpr": 0.4103, "fpr": 0.3333, "youden_j": 0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 97.3, "cvss_fp_weight": 1.0, "cvss_fn_weight": 127.5, "cvss_precision": 0.9898, "cvss_recall": 0.4328, "cvss_f3": 0.4586, "cvss_f3_score": 45.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 15, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-540", "file": "config/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-497", "file": "config/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-470", "file": "config/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-480", "file": "config/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-043", "file": "config/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-236", "file": "config/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": "config/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": "payroll/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": "config/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 22, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.2051, "f1": 0.2319, "f2": 0.2151, "f2_score": 21.5, "f3": 0.21, "f3_score": 21.0, "tpr": 0.2051, "fpr": 0.8462, "youden_j": -0.641, "cvss_coverage": 1.0, "cvss_tp_weight": 49.8, "cvss_fp_weight": 63.0, "cvss_fn_weight": 175.0, "cvss_precision": 0.4415, "cvss_recall": 0.2215, "cvss_f3": 0.2331, "cvss_f3_score": 23.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 18, "recall": 0.1429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-521", "file": "config/payroll_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-294", "file": "config/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-491", "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "config/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-045", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-497", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-540", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 12, "fn": 39, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.75, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 62.7, "cvss_fn_weight": 224.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 21, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/config/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-hr-payroll-django/payroll/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-044", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-045", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-176", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-257", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-355", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-497", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-510", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-521", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-540", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-550", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 52, "fn": 32, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1186, "recall": 0.1795, "f1": 0.1429, "f2": 0.1628, "f2_score": 16.3, "f3": 0.1707, "f3_score": 17.1, "tpr": 0.1795, "fpr": 0.9286, "youden_j": -0.7491, "cvss_coverage": 1.0, "cvss_tp_weight": 37.4, "cvss_fp_weight": 280.4, "cvss_fn_weight": 187.4, "cvss_precision": 0.1177, "cvss_recall": 0.1664, "cvss_f3": 0.1598, "cvss_f3_score": 16.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 17, "recall": 0.1905 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-044", "file": "config/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-045", "file": "config/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-176", "file": "config/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-257", "file": "config/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-355", "file": "config/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-510", "file": "config/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-550", "file": "config/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "config/payroll_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "payroll/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-043", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-130", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-236", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-294", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-460", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-470", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-480", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-491", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-497", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-521", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-530", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-540", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-015", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-016", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-017", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-018", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-019", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-hr-payroll-django-enrich-020", "file": null, "cwe": "CWE-22" } ] } }, "vc-codex-seeded-v2-legal-case-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 9, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.6061, "f1": 0.6452, "f2": 0.6211, "f2_score": 62.1, "f3": 0.6135, "f3_score": 61.3, "tpr": 0.6061, "fpr": 0.6923, "youden_j": -0.0862, "cvss_coverage": 1.0, "cvss_tp_weight": 120.3, "cvss_fp_weight": 37.0, "cvss_fn_weight": 70.0, "cvss_precision": 0.7648, "cvss_recall": 0.6322, "cvss_f3": 0.6433, "cvss_f3_score": 64.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 2, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4242, "f1": 0.5714, "f2": 0.473, "f2_score": 47.3, "f3": 0.4473, "f3_score": 44.7, "tpr": 0.4242, "fpr": 0.3333, "youden_j": 0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 81.7, "cvss_fp_weight": 5.6, "cvss_fn_weight": 108.6, "cvss_precision": 0.9354, "cvss_recall": 0.4293, "cvss_f3": 0.4539, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 6, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.4242, "f1": 0.5283, "f2": 0.4605, "f2_score": 46.1, "f3": 0.4416, "f3_score": 44.2, "tpr": 0.4242, "fpr": 0.6, "youden_j": -0.1758, "cvss_coverage": 1.0, "cvss_tp_weight": 80.7, "cvss_fp_weight": 26.2, "cvss_fn_weight": 109.6, "cvss_precision": 0.7548, "cvss_recall": 0.4241, "cvss_f3": 0.4435, "cvss_f3_score": 44.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.4545, "f1": 0.6, "f2": 0.5034, "f2_score": 50.3, "f3": 0.4777, "f3_score": 47.8, "tpr": 0.4545, "fpr": 0.3333, "youden_j": 0.1212, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 5.6, "cvss_fn_weight": 95.1, "cvss_precision": 0.944, "cvss_recall": 0.5003, "cvss_f3": 0.5249, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.4848, "f1": 0.6038, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5047, "f3_score": 50.5, "tpr": 0.4848, "fpr": 0.5, "youden_j": -0.0152, "cvss_coverage": 1.0, "cvss_tp_weight": 91.3, "cvss_fp_weight": 20.6, "cvss_fn_weight": 99.0, "cvss_precision": 0.8161, "cvss_recall": 0.4798, "cvss_f3": 0.5004, "cvss_f3_score": 50.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 11, "fp": 0, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3333, "f1": 0.5, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3571, "f3_score": 35.7, "tpr": 0.3333, "fpr": 0.0, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 76.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 114.3, "cvss_precision": 1.0, "cvss_recall": 0.3994, "cvss_f3": 0.4249, "cvss_f3_score": 42.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 1, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.2424, "f1": 0.381, "f2": 0.2837, "f2_score": 28.4, "f3": 0.2614, "f3_score": 26.1, "tpr": 0.2424, "fpr": 0.2, "youden_j": 0.0424, "cvss_coverage": 1.0, "cvss_tp_weight": 55.2, "cvss_fp_weight": 0.5, "cvss_fn_weight": 135.1, "cvss_precision": 0.991, "cvss_recall": 0.2901, "cvss_f3": 0.3121, "cvss_f3_score": 31.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 1, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9345, "recall": 0.4141, "f1": 0.5734, "f2": 0.4659, "f2_score": 46.6, "f3": 0.4385, "f3_score": 43.8, "tpr": 0.4141, "fpr": 0.1778, "youden_j": 0.2363, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 5.1, "cvss_fn_weight": 103.7, "cvss_precision": 0.945, "cvss_recall": 0.4551, "cvss_f3": 0.4799, "cvss_f3_score": 48.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 17, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7969, "recall": 0.5051, "f1": 0.6174, "f2": 0.5446, "f2_score": 54.5, "f3": 0.524, "f3_score": 52.4, "tpr": 0.5051, "fpr": 0.5095, "youden_j": -0.0044, "cvss_coverage": 1.0, "cvss_tp_weight": 99.7, "cvss_fp_weight": 17.6, "cvss_fn_weight": 90.6, "cvss_precision": 0.8524, "cvss_recall": 0.5239, "cvss_f3": 0.5448, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 17, "fp": 10, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.66, "recall": 0.5253, "f1": 0.5824, "f2": 0.5462, "f2_score": 54.6, "f3": 0.5355, "f3_score": 53.5, "tpr": 0.5253, "fpr": 0.6641, "youden_j": -0.1389, "cvss_coverage": 1.0, "cvss_tp_weight": 105.1, "cvss_fp_weight": 31.1, "cvss_fn_weight": 85.2, "cvss_precision": 0.7879, "cvss_recall": 0.5523, "cvss_f3": 0.5687, "cvss_f3_score": 56.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-256" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 11, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6562, "recall": 0.6364, "f1": 0.6462, "f2": 0.6402, "f2_score": 64.0, "f3": 0.6383, "f3_score": 63.8, "tpr": 0.6364, "fpr": 0.7333, "youden_j": -0.097, "cvss_coverage": 1.0, "cvss_tp_weight": 121.4, "cvss_fp_weight": 47.3, "cvss_fn_weight": 68.9, "cvss_precision": 0.7197, "cvss_recall": 0.6379, "cvss_f3": 0.6453, "cvss_f3_score": 64.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7652, "recall": 0.5152, "f1": 0.6148, "f2": 0.5507, "f2_score": 55.1, "f3": 0.5323, "f3_score": 53.2, "tpr": 0.5152, "fpr": 0.555, "youden_j": -0.0398, "cvss_coverage": 1.0, "cvss_tp_weight": 103.3, "cvss_fp_weight": 16.6, "cvss_fn_weight": 87.0, "cvss_precision": 0.8684, "cvss_recall": 0.543, "cvss_f3": 0.5639, "cvss_f3_score": 56.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 10, "fp": 3, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.303, "f1": 0.4348, "f2": 0.3448, "f2_score": 34.5, "f3": 0.3226, "f3_score": 32.3, "tpr": 0.303, "fpr": 0.4286, "youden_j": -0.1255, "cvss_coverage": 1.0, "cvss_tp_weight": 67.0, "cvss_fp_weight": 10.8, "cvss_fn_weight": 123.3, "cvss_precision": 0.8613, "cvss_recall": 0.3521, "cvss_f3": 0.3742, "cvss_f3_score": 37.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 33, "fp": 7, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.825, "recall": 1.0, "f1": 0.9041, "f2": 0.9593, "f2_score": 95.9, "f3": 0.9792, "f3_score": 97.9, "tpr": 1.0, "fpr": 0.6364, "youden_j": 0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 190.3, "cvss_fp_weight": 36.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.8409, "cvss_recall": 1.0, "cvss_f3": 0.9814, "cvss_f3_score": 98.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-461", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": "cases/forms.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-863" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 17, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5152, "f1": 0.6538, "f2": 0.5629, "f2_score": 56.3, "f3": 0.538, "f3_score": 53.8, "tpr": 0.5152, "fpr": 0.3333, "youden_j": 0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 100.9, "cvss_fp_weight": 5.6, "cvss_fn_weight": 89.4, "cvss_precision": 0.947, "cvss_recall": 0.5302, "cvss_f3": 0.5546, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6522, "recall": 0.4545, "f1": 0.5357, "f2": 0.4839, "f2_score": 48.4, "f3": 0.4688, "f3_score": 46.9, "tpr": 0.4545, "fpr": 0.6667, "youden_j": -0.2121, "cvss_coverage": 1.0, "cvss_tp_weight": 98.0, "cvss_fp_weight": 41.1, "cvss_fn_weight": 92.3, "cvss_precision": 0.7043, "cvss_recall": 0.515, "cvss_f3": 0.5292, "cvss_f3_score": 52.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-461", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 33, "fp": 4, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8919, "recall": 1.0, "f1": 0.9429, "f2": 0.9763, "f2_score": 97.6, "f3": 0.988, "f3_score": 98.8, "tpr": 1.0, "fpr": 0.5, "youden_j": 0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 190.3, "cvss_fp_weight": 11.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.944, "cvss_recall": 1.0, "cvss_f3": 0.9941, "cvss_f3_score": 99.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-461", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": "cases/forms.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 4, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7984, "recall": 0.3939, "f1": 0.5239, "f2": 0.437, "f2_score": 43.7, "f3": 0.4143, "f3_score": 41.4, "tpr": 0.3939, "fpr": 0.4429, "youden_j": -0.0489, "cvss_coverage": 1.0, "cvss_tp_weight": 78.0, "cvss_fp_weight": 11.1, "cvss_fn_weight": 112.3, "cvss_precision": 0.8837, "cvss_recall": 0.4099, "cvss_f3": 0.4328, "cvss_f3_score": 43.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 3, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.4545, "f1": 0.5882, "f2": 0.5, "f2_score": 50.0, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4545, "fpr": 0.4286, "youden_j": 0.026, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 10.8, "cvss_fn_weight": 95.1, "cvss_precision": 0.8982, "cvss_recall": 0.5003, "cvss_f3": 0.5235, "cvss_f3_score": 52.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 14, "fp": 4, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7872, "recall": 0.4394, "f1": 0.5616, "f2": 0.481, "f2_score": 48.1, "f3": 0.4592, "f3_score": 45.9, "tpr": 0.4394, "fpr": 0.4921, "youden_j": -0.0527, "cvss_coverage": 1.0, "cvss_tp_weight": 88.4, "cvss_fp_weight": 4.3, "cvss_fn_weight": 101.8, "cvss_precision": 0.9568, "cvss_recall": 0.4648, "cvss_f3": 0.4895, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.5152, "f1": 0.6182, "f2": 0.5519, "f2_score": 55.2, "f3": 0.5329, "f3_score": 53.3, "tpr": 0.5152, "fpr": 0.5556, "youden_j": -0.0404, "cvss_coverage": 1.0, "cvss_tp_weight": 101.4, "cvss_fp_weight": 11.8, "cvss_fn_weight": 88.9, "cvss_precision": 0.8959, "cvss_recall": 0.5328, "cvss_f3": 0.5553, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 19, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9048, "recall": 0.5758, "f1": 0.7037, "f2": 0.6209, "f2_score": 62.1, "f3": 0.5975, "f3_score": 59.7, "tpr": 0.5758, "fpr": 0.3333, "youden_j": 0.2424, "cvss_coverage": 1.0, "cvss_tp_weight": 113.3, "cvss_fp_weight": 16.0, "cvss_fn_weight": 77.0, "cvss_precision": 0.8763, "cvss_recall": 0.5954, "cvss_f3": 0.6151, "cvss_f3_score": 61.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 47, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3088, "recall": 0.6364, "f1": 0.4158, "f2": 0.525, "f2_score": 52.5, "f3": 0.5753, "f3_score": 57.5, "tpr": 0.6364, "fpr": 0.9216, "youden_j": -0.2852, "cvss_coverage": 1.0, "cvss_tp_weight": 123.4, "cvss_fp_weight": 293.5, "cvss_fn_weight": 66.9, "cvss_precision": 0.296, "cvss_recall": 0.6484, "cvss_f3": 0.5795, "cvss_f3_score": 57.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": "cases/forms.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 22, "fp": 31, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4151, "recall": 0.6667, "f1": 0.5116, "f2": 0.5946, "f2_score": 59.5, "f3": 0.6286, "f3_score": 62.9, "tpr": 0.6667, "fpr": 0.8857, "youden_j": -0.219, "cvss_coverage": 1.0, "cvss_tp_weight": 123.1, "cvss_fp_weight": 222.5, "cvss_fn_weight": 67.2, "cvss_precision": 0.3562, "cvss_recall": 0.6469, "cvss_f3": 0.5981, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-202" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-461", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": "cases/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 1, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.0606, "f1": 0.1111, "f2": 0.0741, "f2_score": 7.4, "f3": 0.0667, "f3_score": 6.7, "tpr": 0.0606, "fpr": 0.2, "youden_j": -0.1394, "cvss_coverage": 1.0, "cvss_tp_weight": 10.8, "cvss_fp_weight": 8.0, "cvss_fn_weight": 179.5, "cvss_precision": 0.5745, "cvss_recall": 0.0568, "cvss_f3": 0.0624, "cvss_f3_score": 6.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 15, "recall": 0.0625 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 14, "recall": 0.0667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/middleware.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-152", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-177", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-258", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-499", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-502", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-522", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 27, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4808, "recall": 0.7576, "f1": 0.5882, "f2": 0.6793, "f2_score": 67.9, "f3": 0.7163, "f3_score": 71.6, "tpr": 0.7576, "fpr": 0.871, "youden_j": -0.1134, "cvss_coverage": 1.0, "cvss_tp_weight": 145.4, "cvss_fp_weight": 196.5, "cvss_fn_weight": 44.9, "cvss_precision": 0.4253, "cvss_recall": 0.7641, "cvss_f3": 0.7077, "cvss_f3_score": 70.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 7, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7941, "recall": 0.8182, "f1": 0.806, "f2": 0.8133, "f2_score": 81.3, "f3": 0.8157, "f3_score": 81.6, "tpr": 0.8182, "fpr": 0.6364, "youden_j": 0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 157.7, "cvss_fp_weight": 51.0, "cvss_fn_weight": 32.6, "cvss_precision": 0.7556, "cvss_recall": 0.8287, "cvss_f3": 0.8208, "cvss_f3_score": 82.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/templates/cases/notifications.html", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-461", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 20, "fp": 17, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5405, "recall": 0.6061, "f1": 0.5714, "f2": 0.5917, "f2_score": 59.2, "f3": 0.5988, "f3_score": 59.9, "tpr": 0.6061, "fpr": 0.8095, "youden_j": -0.2035, "cvss_coverage": 1.0, "cvss_tp_weight": 119.5, "cvss_fp_weight": 102.5, "cvss_fn_weight": 70.8, "cvss_precision": 0.5383, "cvss_recall": 0.628, "cvss_f3": 0.6177, "cvss_f3_score": 61.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 34, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4237, "recall": 0.7576, "f1": 0.5435, "f2": 0.6545, "f2_score": 65.4, "f3": 0.7022, "f3_score": 70.2, "tpr": 0.7576, "fpr": 0.8947, "youden_j": -0.1372, "cvss_coverage": 1.0, "cvss_tp_weight": 145.4, "cvss_fp_weight": 230.5, "cvss_fn_weight": 44.9, "cvss_precision": 0.3868, "cvss_recall": 0.7641, "cvss_f3": 0.6962, "cvss_f3_score": 69.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/send_deadline_reminders.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": "cases/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": "cases/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": "cases/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": "cases/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-047", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-048", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-531", "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 5, "fp": 3, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3125, "recall": 0.1515, "f1": 0.2041, "f2": 0.1689, "f2_score": 16.9, "f3": 0.1598, "f3_score": 15.9, "tpr": 0.1515, "fpr": 0.3, "youden_j": -0.1485, "cvss_coverage": 1.0, "cvss_tp_weight": 32.0, "cvss_fp_weight": 13.1, "cvss_fn_weight": 158.2, "cvss_precision": 0.3548, "cvss_recall": 0.1684, "cvss_f3": 0.1777, "cvss_f3_score": 17.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-152", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-177", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-258", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-499", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-502", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-522", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 9, "fn": 21, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.3636, "f1": 0.4444, "f2": 0.3922, "f2_score": 39.2, "f3": 0.3774, "f3_score": 37.7, "tpr": 0.3636, "fpr": 0.75, "youden_j": -0.3864, "cvss_coverage": 1.0, "cvss_tp_weight": 79.2, "cvss_fp_weight": 41.6, "cvss_fn_weight": 111.1, "cvss_precision": 0.6554, "cvss_recall": 0.4162, "cvss_f3": 0.4319, "cvss_f3_score": 43.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 1, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-541", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-348", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-354" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 7, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.3939, "f1": 0.4906, "f2": 0.4276, "f2_score": 42.8, "f3": 0.4101, "f3_score": 41.0, "tpr": 0.3939, "fpr": 0.6364, "youden_j": -0.2424, "cvss_coverage": 1.0, "cvss_tp_weight": 78.4, "cvss_fp_weight": 26.7, "cvss_fn_weight": 111.9, "cvss_precision": 0.7458, "cvss_recall": 0.412, "cvss_f3": 0.4313, "cvss_f3_score": 43.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-152", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-481", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-217", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-499", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-046", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-471", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 22, "fn": 27, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.1818, "f1": 0.1967, "f2": 0.1875, "f2_score": 18.8, "f3": 0.1846, "f3_score": 18.5, "tpr": 0.1818, "fpr": 0.88, "youden_j": -0.6982, "cvss_coverage": 1.0, "cvss_tp_weight": 39.5, "cvss_fp_weight": 89.0, "cvss_fn_weight": 150.8, "cvss_precision": 0.3074, "cvss_recall": 0.2076, "cvss_f3": 0.2145, "cvss_f3_score": 21.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 13, "recall": 0.1875 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": "cases/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-522", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-295", "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-152", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-499", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 10, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7143, "youden_j": -0.7143, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 51.4, "cvss_fn_weight": 190.3, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-152", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-177", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-258", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-499", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-502", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-511", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-522", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-551", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 46, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.098, "recall": 0.1515, "f1": 0.119, "f2": 0.1366, "f2_score": 13.7, "f3": 0.1437, "f3_score": 14.4, "tpr": 0.1515, "fpr": 0.92, "youden_j": -0.7685, "cvss_coverage": 1.0, "cvss_tp_weight": 32.4, "cvss_fp_weight": 245.3, "cvss_fn_weight": 157.9, "cvss_precision": 0.1167, "cvss_recall": 0.1703, "cvss_f3": 0.1628, "cvss_f3_score": 16.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/management/commands/seed_demo.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "cases/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-177", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-258", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-502", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-511", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-551", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-046", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-047", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-048", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-152", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-217", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-295", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-348", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-461", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-471", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-481", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-499", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-522", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-531", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-541", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-008", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-012", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-013", "file": null, "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-legal-case-django-enrich-014", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-seeded-v2-logistics-dispatch-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 22, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 0.7333, "f1": 0.7586, "f2": 0.7432, "f2_score": 74.3, "f3": 0.7383, "f3_score": 73.8, "tpr": 0.7333, "fpr": 0.6, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 129.6, "cvss_fp_weight": 30.6, "cvss_fn_weight": 43.8, "cvss_precision": 0.809, "cvss_recall": 0.7474, "cvss_f3": 0.7531, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-049", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-532", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 6, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7391, "recall": 0.5667, "f1": 0.6415, "f2": 0.5944, "f2_score": 59.4, "f3": 0.5802, "f3_score": 58.0, "tpr": 0.5667, "fpr": 0.6, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 100.2, "cvss_fp_weight": 21.4, "cvss_fn_weight": 73.2, "cvss_precision": 0.824, "cvss_recall": 0.5779, "cvss_f3": 0.5956, "cvss_f3_score": 59.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4667, "f1": 0.6087, "f2": 0.5147, "f2_score": 51.5, "f3": 0.4895, "f3_score": 49.0, "tpr": 0.4667, "fpr": 0.3333, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 87.5, "cvss_fp_weight": 10.2, "cvss_fn_weight": 85.9, "cvss_precision": 0.8956, "cvss_recall": 0.5046, "cvss_f3": 0.5276, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.5, "f1": 0.6122, "f2": 0.5396, "f2_score": 54.0, "f3": 0.519, "f3_score": 51.9, "tpr": 0.5, "fpr": 0.5, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 6.6, "cvss_fn_weight": 82.8, "cvss_precision": 0.9321, "cvss_recall": 0.5225, "cvss_f3": 0.5465, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 8, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.6, "f1": 0.6429, "f2": 0.6164, "f2_score": 61.6, "f3": 0.6081, "f3_score": 60.8, "tpr": 0.6, "fpr": 0.7273, "youden_j": -0.1273, "cvss_coverage": 1.0, "cvss_tp_weight": 102.5, "cvss_fp_weight": 36.2, "cvss_fn_weight": 70.9, "cvss_precision": 0.739, "cvss_recall": 0.5911, "cvss_f3": 0.6032, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 9, "fp": 1, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-049", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 12, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4167, "f1": 0.588, "f2": 0.4716, "f2_score": 47.2, "f3": 0.4425, "f3_score": 44.2, "tpr": 0.4167, "fpr": 0.0, "youden_j": 0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 74.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 98.5, "cvss_precision": 1.0, "cvss_recall": 0.4316, "cvss_f3": 0.4577, "cvss_f3_score": 45.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 12, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4, "f1": 0.5714, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4255, "f3_score": 42.6, "tpr": 0.4, "fpr": 0.0, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 71.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 102.1, "cvss_precision": 1.0, "cvss_recall": 0.4112, "cvss_f3": 0.4369, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 1, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9203, "recall": 0.4778, "f1": 0.6281, "f2": 0.5283, "f2_score": 52.8, "f3": 0.5018, "f3_score": 50.2, "tpr": 0.4778, "fpr": 0.2095, "youden_j": 0.2683, "cvss_coverage": 1.0, "cvss_tp_weight": 87.3, "cvss_fp_weight": 5.3, "cvss_fn_weight": 86.1, "cvss_precision": 0.9452, "cvss_recall": 0.5037, "cvss_f3": 0.5282, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 18, "fp": 3, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8714, "recall": 0.6, "f1": 0.7106, "f2": 0.6398, "f2_score": 64.0, "f3": 0.6193, "f3_score": 61.9, "tpr": 0.6, "fpr": 0.3889, "youden_j": 0.2111, "cvss_coverage": 1.0, "cvss_tp_weight": 106.5, "cvss_fp_weight": 5.9, "cvss_fn_weight": 66.9, "cvss_precision": 0.9476, "cvss_recall": 0.6142, "cvss_f3": 0.6365, "cvss_f3_score": 63.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 19, "fp": 4, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8271, "recall": 0.6333, "f1": 0.7172, "f2": 0.6643, "f2_score": 66.4, "f3": 0.6485, "f3_score": 64.8, "tpr": 0.6333, "fpr": 0.4947, "youden_j": 0.1386, "cvss_coverage": 1.0, "cvss_tp_weight": 114.6, "cvss_fp_weight": 6.6, "cvss_fn_weight": 58.8, "cvss_precision": 0.9485, "cvss_recall": 0.6609, "cvss_f3": 0.6814, "cvss_f3_score": 68.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 11, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6562, "recall": 0.7, "f1": 0.6774, "f2": 0.6908, "f2_score": 69.1, "f3": 0.6954, "f3_score": 69.5, "tpr": 0.7, "fpr": 0.7333, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 121.8, "cvss_fp_weight": 46.9, "cvss_fn_weight": 51.6, "cvss_precision": 0.722, "cvss_recall": 0.7024, "cvss_f3": 0.7043, "cvss_f3_score": 70.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 19, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.782, "recall": 0.6333, "f1": 0.6996, "f2": 0.6582, "f2_score": 65.8, "f3": 0.6456, "f3_score": 64.5, "tpr": 0.6333, "fpr": 0.5667, "youden_j": 0.0666, "cvss_coverage": 1.0, "cvss_tp_weight": 114.6, "cvss_fp_weight": 16.5, "cvss_fn_weight": 58.8, "cvss_precision": 0.8752, "cvss_recall": 0.6609, "cvss_f3": 0.6775, "cvss_f3_score": 67.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 15, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.5, "f1": 0.6383, "f2": 0.5474, "f2_score": 54.7, "f3": 0.5226, "f3_score": 52.3, "tpr": 0.5, "fpr": 0.3333, "youden_j": 0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 93.1, "cvss_fp_weight": 10.2, "cvss_fn_weight": 80.3, "cvss_precision": 0.9013, "cvss_recall": 0.5369, "cvss_f3": 0.5595, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-540" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 30, "fp": 8, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 1.0, "f1": 0.8824, "f2": 0.9494, "f2_score": 94.9, "f3": 0.974, "f3_score": 97.4, "tpr": 1.0, "fpr": 0.6667, "youden_j": 0.3333, "cvss_coverage": 1.0, "cvss_tp_weight": 173.4, "cvss_fp_weight": 40.8, "cvss_fn_weight": 0.0, "cvss_precision": 0.8095, "cvss_recall": 1.0, "cvss_f3": 0.977, "cvss_f3_score": 97.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-049", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-532", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5, "f1": 0.625, "f2": 0.5435, "f2_score": 54.3, "f3": 0.5208, "f3_score": 52.1, "tpr": 0.5, "fpr": 0.4286, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 95.7, "cvss_fp_weight": 10.7, "cvss_fn_weight": 77.7, "cvss_precision": 0.8994, "cvss_recall": 0.5519, "cvss_f3": 0.5741, "cvss_f3_score": 57.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7619, "recall": 0.5333, "f1": 0.6275, "f2": 0.5674, "f2_score": 56.7, "f3": 0.5498, "f3_score": 55.0, "tpr": 0.5333, "fpr": 0.5556, "youden_j": -0.0222, "cvss_coverage": 1.0, "cvss_tp_weight": 101.1, "cvss_fp_weight": 25.5, "cvss_fn_weight": 72.3, "cvss_precision": 0.7986, "cvss_recall": 0.583, "cvss_f3": 0.5992, "cvss_f3_score": 59.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-552", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 30, "fp": 13, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6977, "recall": 1.0, "f1": 0.8219, "f2": 0.9202, "f2_score": 92.0, "f3": 0.9585, "f3_score": 95.8, "tpr": 1.0, "fpr": 0.7647, "youden_j": 0.2353, "cvss_coverage": 1.0, "cvss_tp_weight": 173.4, "cvss_fp_weight": 61.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.7376, "cvss_recall": 1.0, "cvss_f3": 0.9656, "cvss_f3_score": 96.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-049", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-532", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 15, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8255, "recall": 0.4889, "f1": 0.6105, "f2": 0.5308, "f2_score": 53.0, "f3": 0.5089, "f3_score": 50.9, "tpr": 0.4889, "fpr": 0.4222, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 86.0, "cvss_fp_weight": 10.9, "cvss_fn_weight": 87.4, "cvss_precision": 0.89, "cvss_recall": 0.4958, "cvss_f3": 0.5184, "cvss_f3_score": 51.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 16, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5333, "f1": 0.6667, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5333, "fpr": 0.3333, "youden_j": 0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 1.0, "cvss_fn_weight": 76.6, "cvss_precision": 0.9898, "cvss_recall": 0.5582, "cvss_f3": 0.5837, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7329, "recall": 0.5167, "f1": 0.6012, "f2": 0.5467, "f2_score": 54.7, "f3": 0.5312, "f3_score": 53.2, "tpr": 0.5167, "fpr": 0.5333, "youden_j": -0.0166, "cvss_coverage": 1.0, "cvss_tp_weight": 93.3, "cvss_fp_weight": 7.8, "cvss_fn_weight": 80.1, "cvss_precision": 0.9227, "cvss_recall": 0.5381, "cvss_f3": 0.5615, "cvss_f3_score": 56.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 19, "fp": 4, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8261, "recall": 0.6333, "f1": 0.717, "f2": 0.6643, "f2_score": 66.4, "f3": 0.6485, "f3_score": 64.8, "tpr": 0.6333, "fpr": 0.5, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 112.1, "cvss_fp_weight": 6.6, "cvss_fn_weight": 61.3, "cvss_precision": 0.9444, "cvss_recall": 0.6465, "cvss_f3": 0.6675, "cvss_f3_score": 66.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 17, "fp": 2, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8947, "recall": 0.5667, "f1": 0.6939, "f2": 0.6115, "f2_score": 61.2, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.5667, "fpr": 0.3333, "youden_j": 0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 93.4, "cvss_fp_weight": 7.5, "cvss_fn_weight": 80.0, "cvss_precision": 0.9257, "cvss_recall": 0.5386, "cvss_f3": 0.5621, "cvss_f3_score": 56.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 28, "fp": 53, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3457, "recall": 0.9333, "f1": 0.5045, "f2": 0.6965, "f2_score": 69.7, "f3": 0.7977, "f3_score": 79.8, "tpr": 0.9333, "fpr": 0.9464, "youden_j": -0.0131, "cvss_coverage": 1.0, "cvss_tp_weight": 160.4, "cvss_fp_weight": 359.0, "cvss_fn_weight": 13.0, "cvss_precision": 0.3088, "cvss_recall": 0.925, "cvss_f3": 0.7712, "cvss_f3_score": 77.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "medium": { "tp": 15, "fp": 1, "fn": 1, "recall": 0.9375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-257" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-313" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 24, "fp": 20, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.8, "f1": 0.6486, "f2": 0.7317, "f2_score": 73.2, "f3": 0.7643, "f3_score": 76.4, "tpr": 0.8, "fpr": 0.8333, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 140.8, "cvss_fp_weight": 126.0, "cvss_fn_weight": 32.6, "cvss_precision": 0.5277, "cvss_recall": 0.812, "cvss_f3": 0.7705, "cvss_f3_score": 77.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 0, "fp": 0, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 173.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-050", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-051", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-156", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-259", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-323", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-487", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-518", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-542", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-552", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 27, "fp": 49, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3553, "recall": 0.9, "f1": 0.5094, "f2": 0.6888, "f2_score": 68.9, "f3": 0.7803, "f3_score": 78.0, "tpr": 0.9, "fpr": 0.9423, "youden_j": -0.0423, "cvss_coverage": 1.0, "cvss_tp_weight": 152.2, "cvss_fp_weight": 327.5, "cvss_fn_weight": 21.2, "cvss_precision": 0.3173, "cvss_recall": 0.8777, "cvss_f3": 0.746, "cvss_f3_score": 74.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 15, "fp": 1, "fn": 1, "recall": 0.9375 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 7, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7941, "recall": 0.9, "f1": 0.8438, "f2": 0.8766, "f2_score": 87.7, "f3": 0.8882, "f3_score": 88.8, "tpr": 0.9, "fpr": 0.6364, "youden_j": 0.2636, "cvss_coverage": 1.0, "cvss_tp_weight": 159.7, "cvss_fp_weight": 53.5, "cvss_fn_weight": 13.7, "cvss_precision": 0.7491, "cvss_recall": 0.921, "cvss_f3": 0.9003, "cvss_f3_score": 90.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 }, "medium": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-049", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-532", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-323", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 19, "fp": 28, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4043, "recall": 0.6333, "f1": 0.4935, "f2": 0.5689, "f2_score": 56.9, "f3": 0.5994, "f3_score": 59.9, "tpr": 0.6333, "fpr": 0.875, "youden_j": -0.2417, "cvss_coverage": 1.0, "cvss_tp_weight": 114.7, "cvss_fp_weight": 176.0, "cvss_fn_weight": 58.7, "cvss_precision": 0.3946, "cvss_recall": 0.6615, "cvss_f3": 0.6196, "cvss_f3_score": 62.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-552", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 27, "fp": 60, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3103, "recall": 0.9, "f1": 0.4615, "f2": 0.6522, "f2_score": 65.2, "f3": 0.7563, "f3_score": 75.6, "tpr": 0.9, "fpr": 0.9524, "youden_j": -0.0524, "cvss_coverage": 1.0, "cvss_tp_weight": 152.2, "cvss_fp_weight": 392.0, "cvss_fn_weight": 21.2, "cvss_precision": 0.2797, "cvss_recall": 0.8777, "cvss_f3": 0.7231, "cvss_f3_score": 72.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 15, "fp": 1, "fn": 1, "recall": 0.9375 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-131", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-462", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/run_due_notifications.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 2, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8474, "recall": 0.35, "f1": 0.4939, "f2": 0.3961, "f2_score": 39.6, "f3": 0.3716, "f3_score": 37.2, "tpr": 0.35, "fpr": 0.3143, "youden_j": 0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 64.7, "cvss_fp_weight": 10.2, "cvss_fn_weight": 108.8, "cvss_precision": 0.8694, "cvss_recall": 0.3729, "cvss_f3": 0.3952, "cvss_f3_score": 39.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-487", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 7, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.4, "f1": 0.4898, "f2": 0.4317, "f2_score": 43.2, "f3": 0.4152, "f3_score": 41.5, "tpr": 0.4, "fpr": 0.6364, "youden_j": -0.2364, "cvss_coverage": 1.0, "cvss_tp_weight": 72.3, "cvss_fp_weight": 21.9, "cvss_fn_weight": 101.1, "cvss_precision": 0.7675, "cvss_recall": 0.417, "cvss_f3": 0.4369, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-218", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": ".env.example", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 11, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5769, "recall": 0.5, "f1": 0.5357, "f2": 0.5137, "f2_score": 51.4, "f3": 0.5068, "f3_score": 50.7, "tpr": 0.5, "fpr": 0.7333, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 88.8, "cvss_fp_weight": 19.3, "cvss_fn_weight": 84.6, "cvss_precision": 0.8215, "cvss_recall": 0.5121, "cvss_f3": 0.5322, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-498", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-050", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-542", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-482", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-308", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-472", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-487", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 10, "fp": 32, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.3333, "f1": 0.2778, "f2": 0.3086, "f2_score": 30.9, "f3": 0.3205, "f3_score": 32.1, "tpr": 0.3333, "fpr": 0.8889, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 59.5, "cvss_fp_weight": 159.0, "cvss_fn_weight": 113.9, "cvss_precision": 0.2723, "cvss_recall": 0.3431, "cvss_f3": 0.3344, "cvss_f3_score": 33.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-487", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-323", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-518", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authorization_workflow.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api/client.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-050", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-156", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-542", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 6, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 26.0, "cvss_fn_weight": 173.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-logistics-dispatch-fastapi/backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-050", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-051", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-156", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-259", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-323", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-487", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-512", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-518", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-542", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-552", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 5, "fn": 23, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.2333, "f1": 0.3333, "f2": 0.2652, "f2_score": 26.5, "f3": 0.2482, "f3_score": 24.8, "tpr": 0.2333, "fpr": 0.5556, "youden_j": -0.3222, "cvss_coverage": 1.0, "cvss_tp_weight": 39.8, "cvss_fp_weight": 38.7, "cvss_fn_weight": 133.6, "cvss_precision": 0.507, "cvss_recall": 0.2295, "cvss_f3": 0.2428, "cvss_f3_score": 24.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-051", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-156", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-259", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-512", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-552", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-049", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-050", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-131", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-218", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-308", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-323", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-462", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-472", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-482", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-487", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-498", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-518", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-532", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-542", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-seeded-v2-marketplace-commerce-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 9, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.7241, "f1": 0.7119, "f2": 0.7192, "f2_score": 71.9, "f3": 0.7216, "f3_score": 72.2, "tpr": 0.7241, "fpr": 0.6923, "youden_j": 0.0318, "cvss_coverage": 1.0, "cvss_tp_weight": 132.4, "cvss_fp_weight": 47.9, "cvss_fn_weight": 43.3, "cvss_precision": 0.7343, "cvss_recall": 0.7536, "cvss_f3": 0.7516, "cvss_f3_score": 75.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-533", "file": "app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 8, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.68, "recall": 0.5862, "f1": 0.6296, "f2": 0.6028, "f2_score": 60.3, "f3": 0.5944, "f3_score": 59.4, "tpr": 0.5862, "fpr": 0.6667, "youden_j": -0.0805, "cvss_coverage": 1.0, "cvss_tp_weight": 109.9, "cvss_fp_weight": 28.1, "cvss_fn_weight": 65.8, "cvss_precision": 0.7963, "cvss_recall": 0.6255, "cvss_f3": 0.6392, "cvss_f3_score": 63.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-533", "file": "app/seller_operations.py", "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 2, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4828, "f1": 0.6222, "f2": 0.5303, "f2_score": 53.0, "f3": 0.5054, "f3_score": 50.5, "tpr": 0.4828, "fpr": 0.4, "youden_j": 0.0828, "cvss_coverage": 1.0, "cvss_tp_weight": 93.2, "cvss_fp_weight": 5.8, "cvss_fn_weight": 82.5, "cvss_precision": 0.9412, "cvss_recall": 0.5304, "cvss_f3": 0.5547, "cvss_f3_score": 55.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 1, "fn": 11, "precision": 0.8333, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 3, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.4138, "f1": 0.5455, "f2": 0.458, "f2_score": 45.8, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4138, "fpr": 0.4286, "youden_j": -0.0148, "cvss_coverage": 1.0, "cvss_tp_weight": 82.4, "cvss_fp_weight": 6.3, "cvss_fn_weight": 93.3, "cvss_precision": 0.9287, "cvss_recall": 0.469, "cvss_f3": 0.4934, "cvss_f3_score": 49.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 14, "fp": 11, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.4828, "f1": 0.5185, "f2": 0.4965, "f2_score": 49.6, "f3": 0.4895, "f3_score": 49.0, "tpr": 0.4828, "fpr": 0.7333, "youden_j": -0.2506, "cvss_coverage": 1.0, "cvss_tp_weight": 87.8, "cvss_fp_weight": 53.7, "cvss_fn_weight": 87.9, "cvss_precision": 0.6203, "cvss_recall": 0.4997, "cvss_f3": 0.5096, "cvss_f3_score": 51.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-472" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 1, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9129, "recall": 0.362, "f1": 0.5183, "f2": 0.4117, "f2_score": 41.2, "f3": 0.3852, "f3_score": 38.5, "tpr": 0.362, "fpr": 0.2, "youden_j": 0.162, "cvss_coverage": 1.0, "cvss_tp_weight": 69.9, "cvss_fp_weight": 5.3, "cvss_fn_weight": 105.8, "cvss_precision": 0.9292, "cvss_recall": 0.3982, "cvss_f3": 0.4222, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.2759, "f1": 0.4211, "f2": 0.32, "f2_score": 32.0, "f3": 0.2963, "f3_score": 29.6, "tpr": 0.2759, "fpr": 0.2, "youden_j": 0.0759, "cvss_coverage": 1.0, "cvss_tp_weight": 56.6, "cvss_fp_weight": 5.3, "cvss_fn_weight": 119.1, "cvss_precision": 0.914, "cvss_recall": 0.3221, "cvss_f3": 0.3444, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 11, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8217, "recall": 0.3678, "f1": 0.5077, "f2": 0.4134, "f2_score": 41.3, "f3": 0.3893, "f3_score": 38.9, "tpr": 0.3678, "fpr": 0.3651, "youden_j": 0.0027, "cvss_coverage": 1.0, "cvss_tp_weight": 73.3, "cvss_fp_weight": 9.2, "cvss_fn_weight": 102.4, "cvss_precision": 0.8881, "cvss_recall": 0.4172, "cvss_f3": 0.4405, "cvss_f3_score": 44.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 12, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 18, "fp": 6, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7624, "recall": 0.6092, "f1": 0.6763, "f2": 0.6342, "f2_score": 63.4, "f3": 0.6214, "f3_score": 62.1, "tpr": 0.6092, "fpr": 0.5651, "youden_j": 0.0441, "cvss_coverage": 1.0, "cvss_tp_weight": 113.6, "cvss_fp_weight": 18.9, "cvss_fn_weight": 62.1, "cvss_precision": 0.8588, "cvss_recall": 0.6468, "cvss_f3": 0.6631, "cvss_f3_score": 66.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6772, "recall": 0.5632, "f1": 0.6132, "f2": 0.5819, "f2_score": 58.2, "f3": 0.5724, "f3_score": 57.2, "tpr": 0.5632, "fpr": 0.6541, "youden_j": -0.0908, "cvss_coverage": 1.0, "cvss_tp_weight": 106.1, "cvss_fp_weight": 24.9, "cvss_fn_weight": 69.6, "cvss_precision": 0.8138, "cvss_recall": 0.6039, "cvss_f3": 0.6196, "cvss_f3_score": 62.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 16, "fp": 17, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4848, "recall": 0.5517, "f1": 0.5161, "f2": 0.5369, "f2_score": 53.7, "f3": 0.5442, "f3_score": 54.4, "tpr": 0.5517, "fpr": 0.8095, "youden_j": -0.2578, "cvss_coverage": 1.0, "cvss_tp_weight": 102.8, "cvss_fp_weight": 66.4, "cvss_fn_weight": 72.9, "cvss_precision": 0.6076, "cvss_recall": 0.5851, "cvss_f3": 0.5873, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7139, "recall": 0.5172, "f1": 0.5996, "f2": 0.5473, "f2_score": 54.7, "f3": 0.5318, "f3_score": 53.2, "tpr": 0.5172, "fpr": 0.6, "youden_j": -0.0828, "cvss_coverage": 1.0, "cvss_tp_weight": 98.6, "cvss_fp_weight": 19.1, "cvss_fn_weight": 77.1, "cvss_precision": 0.838, "cvss_recall": 0.561, "cvss_f3": 0.5801, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 15, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8824, "recall": 0.5172, "f1": 0.6522, "f2": 0.5639, "f2_score": 56.4, "f3": 0.5396, "f3_score": 54.0, "tpr": 0.5172, "fpr": 0.3333, "youden_j": 0.1839, "cvss_coverage": 1.0, "cvss_tp_weight": 96.3, "cvss_fp_weight": 5.8, "cvss_fn_weight": 79.4, "cvss_precision": 0.943, "cvss_recall": 0.5481, "cvss_f3": 0.572, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 21, "fp": 11, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6562, "recall": 0.7241, "f1": 0.6885, "f2": 0.7095, "f2_score": 70.9, "f3": 0.7167, "f3_score": 71.7, "tpr": 0.7241, "fpr": 0.7333, "youden_j": -0.0092, "cvss_coverage": 1.0, "cvss_tp_weight": 131.4, "cvss_fp_weight": 53.7, "cvss_fn_weight": 44.3, "cvss_precision": 0.7097, "cvss_recall": 0.7479, "cvss_f3": 0.7439, "cvss_f3_score": 74.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-463", "file": "app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 15, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5172, "f1": 0.6122, "f2": 0.5515, "f2_score": 55.1, "f3": 0.5338, "f3_score": 53.4, "tpr": 0.5172, "fpr": 0.5556, "youden_j": -0.0383, "cvss_coverage": 1.0, "cvss_tp_weight": 101.9, "cvss_fp_weight": 12.1, "cvss_fn_weight": 73.8, "cvss_precision": 0.8935, "cvss_recall": 0.58, "cvss_f3": 0.6011, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 11, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.4828, "f1": 0.5185, "f2": 0.4965, "f2_score": 49.6, "f3": 0.4895, "f3_score": 49.0, "tpr": 0.4828, "fpr": 0.7333, "youden_j": -0.2506, "cvss_coverage": 1.0, "cvss_tp_weight": 93.7, "cvss_fp_weight": 53.7, "cvss_fn_weight": 82.0, "cvss_precision": 0.6355, "cvss_recall": 0.5333, "cvss_f3": 0.542, "cvss_f3_score": 54.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 14, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4828, "f1": 0.5957, "f2": 0.5224, "f2_score": 52.2, "f3": 0.5018, "f3_score": 50.2, "tpr": 0.4828, "fpr": 0.5, "youden_j": -0.0172, "cvss_coverage": 1.0, "cvss_tp_weight": 87.8, "cvss_fp_weight": 16.5, "cvss_fn_weight": 87.9, "cvss_precision": 0.842, "cvss_recall": 0.4997, "cvss_f3": 0.5209, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7821, "recall": 0.4253, "f1": 0.5469, "f2": 0.4664, "f2_score": 46.6, "f3": 0.4448, "f3_score": 44.5, "tpr": 0.4253, "fpr": 0.454, "youden_j": -0.0287, "cvss_coverage": 1.0, "cvss_tp_weight": 81.7, "cvss_fp_weight": 16.3, "cvss_fn_weight": 94.0, "cvss_precision": 0.8368, "cvss_recall": 0.4652, "cvss_f3": 0.4866, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4828, "f1": 0.5957, "f2": 0.5224, "f2_score": 52.2, "f3": 0.5018, "f3_score": 50.2, "tpr": 0.4828, "fpr": 0.5, "youden_j": -0.0172, "cvss_coverage": 1.0, "cvss_tp_weight": 93.2, "cvss_fp_weight": 11.6, "cvss_fn_weight": 82.5, "cvss_precision": 0.8889, "cvss_recall": 0.5304, "cvss_f3": 0.5527, "cvss_f3_score": 55.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 9, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6218, "recall": 0.5057, "f1": 0.5556, "f2": 0.5242, "f2_score": 52.4, "f3": 0.5147, "f3_score": 51.5, "tpr": 0.5057, "fpr": 0.6796, "youden_j": -0.1739, "cvss_coverage": 1.0, "cvss_tp_weight": 96.4, "cvss_fp_weight": 28.8, "cvss_fn_weight": 79.3, "cvss_precision": 0.7774, "cvss_recall": 0.5486, "cvss_f3": 0.5649, "cvss_f3_score": 56.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 9, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 5, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7826, "recall": 0.6207, "f1": 0.6923, "f2": 0.6475, "f2_score": 64.7, "f3": 0.6338, "f3_score": 63.4, "tpr": 0.6207, "fpr": 0.5556, "youden_j": 0.0651, "cvss_coverage": 1.0, "cvss_tp_weight": 115.8, "cvss_fp_weight": 12.1, "cvss_fn_weight": 59.9, "cvss_precision": 0.9051, "cvss_recall": 0.6591, "cvss_f3": 0.6775, "cvss_f3_score": 67.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-132", "file": "app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 14, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.4828, "f1": 0.6222, "f2": 0.5303, "f2_score": 53.0, "f3": 0.5054, "f3_score": 50.5, "tpr": 0.4828, "fpr": 0.3333, "youden_j": 0.1494, "cvss_coverage": 1.0, "cvss_tp_weight": 87.2, "cvss_fp_weight": 10.0, "cvss_fn_weight": 88.5, "cvss_precision": 0.8971, "cvss_recall": 0.4963, "cvss_f3": 0.5195, "cvss_f3_score": 52.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 24, "fp": 46, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3429, "recall": 0.8276, "f1": 0.4848, "f2": 0.6452, "f2_score": 64.5, "f3": 0.7251, "f3_score": 72.5, "tpr": 0.8276, "fpr": 0.9388, "youden_j": -0.1112, "cvss_coverage": 1.0, "cvss_tp_weight": 147.1, "cvss_fp_weight": 296.0, "cvss_fn_weight": 28.6, "cvss_precision": 0.332, "cvss_recall": 0.8372, "cvss_f3": 0.7266, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 1, "fn": 4, "precision": 0.9231, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-463", "file": "app/seller_operations.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-93" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 22, "fp": 25, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4681, "recall": 0.7586, "f1": 0.5789, "f2": 0.6748, "f2_score": 67.5, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7586, "fpr": 0.8929, "youden_j": -0.1342, "cvss_coverage": 1.0, "cvss_tp_weight": 136.3, "cvss_fp_weight": 164.5, "cvss_fn_weight": 39.4, "cvss_precision": 0.4531, "cvss_recall": 0.7758, "cvss_f3": 0.7242, "cvss_f3_score": 72.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 1, "fn": 4, "precision": 0.9231, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-754" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 0, "fp": 0, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 175.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-260", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-324", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-492", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-503", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-523", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 29, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.463, "recall": 0.8621, "f1": 0.6024, "f2": 0.7353, "f2_score": 73.5, "f3": 0.7937, "f3_score": 79.4, "tpr": 0.8621, "fpr": 0.9062, "youden_j": -0.0442, "cvss_coverage": 1.0, "cvss_tp_weight": 152.5, "cvss_fp_weight": 215.5, "cvss_fn_weight": 23.2, "cvss_precision": 0.4144, "cvss_recall": 0.868, "cvss_f3": 0.7823, "cvss_f3_score": 78.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 1, "fn": 3, "precision": 0.9286, "recall": 0.8125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-132", "file": "app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 10, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7297, "recall": 0.931, "f1": 0.8182, "f2": 0.8824, "f2_score": 88.2, "f3": 0.906, "f3_score": 90.6, "tpr": 0.931, "fpr": 0.7143, "youden_j": 0.2167, "cvss_coverage": 1.0, "cvss_tp_weight": 168.5, "cvss_fp_weight": 77.5, "cvss_fn_weight": 7.2, "cvss_precision": 0.685, "cvss_recall": 0.959, "cvss_f3": 0.9221, "cvss_f3_score": 92.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-132", "file": "app/seller_operations.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-463", "file": "app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "app/services.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-533", "file": "app/seller_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-324", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 12, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.5862, "f1": 0.5862, "f2": 0.5862, "f2_score": 58.6, "f3": 0.5862, "f3_score": 58.6, "tpr": 0.5862, "fpr": 0.75, "youden_j": -0.1638, "cvss_coverage": 1.0, "cvss_tp_weight": 105.2, "cvss_fp_weight": 62.5, "cvss_fn_weight": 70.5, "cvss_precision": 0.6273, "cvss_recall": 0.5987, "cvss_f3": 0.6015, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 44, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3623, "recall": 0.8621, "f1": 0.5102, "f2": 0.6757, "f2_score": 67.6, "f3": 0.7576, "f3_score": 75.8, "tpr": 0.8621, "fpr": 0.9362, "youden_j": -0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 152.5, "cvss_fp_weight": 307.0, "cvss_fn_weight": 23.2, "cvss_precision": 0.3319, "cvss_recall": 0.868, "cvss_f3": 0.7473, "cvss_f3_score": 74.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 1, "fn": 3, "precision": 0.9286, "recall": 0.8125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 0, "fp": 1, "fn": 0, "recall": 0.0 }, "medium": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": "app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-132", "file": "app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-215", "file": "app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-237", "file": "app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-309", "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-473", "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-543", "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "app/services.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 8, "fp": 7, "fn": 21, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.2759, "f1": 0.3636, "f2": 0.3053, "f2_score": 30.5, "f3": 0.2899, "f3_score": 29.0, "tpr": 0.2759, "fpr": 0.7778, "youden_j": -0.5019, "cvss_coverage": 1.0, "cvss_tp_weight": 57.6, "cvss_fp_weight": 37.3, "cvss_fn_weight": 118.1, "cvss_precision": 0.6071, "cvss_recall": 0.3278, "cvss_f3": 0.3436, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 1, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 14, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": "app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 10, "fp": 18, "fn": 19, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3571, "recall": 0.3448, "f1": 0.3509, "f2": 0.3472, "f2_score": 34.7, "f3": 0.346, "f3_score": 34.6, "tpr": 0.3448, "fpr": 0.8571, "youden_j": -0.5123, "cvss_coverage": 1.0, "cvss_tp_weight": 68.7, "cvss_fp_weight": 76.5, "cvss_fn_weight": 107.0, "cvss_precision": 0.473, "cvss_recall": 0.391, "cvss_f3": 0.3979, "cvss_f3_score": 39.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 6, "fp": 1, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-492", "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-053", "file": "app/seller_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-054", "file": "app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 12, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.2414, "f1": 0.2917, "f2": 0.2593, "f2_score": 25.9, "f3": 0.25, "f3_score": 25.0, "tpr": 0.2414, "fpr": 0.8, "youden_j": -0.5586, "cvss_coverage": 1.0, "cvss_tp_weight": 47.5, "cvss_fp_weight": 80.5, "cvss_fn_weight": 128.2, "cvss_precision": 0.3711, "cvss_recall": 0.2703, "cvss_f3": 0.2779, "cvss_f3_score": 27.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-483", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": "app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-324", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-523", "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "tests/test_authz_workflows.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-492", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 7, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6364, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 32.4, "cvss_fn_weight": 175.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/app/seller_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/static/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/static/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-marketplace-commerce-fastapi/static/index.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-052", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-260", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-324", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-492", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-503", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-513", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-523", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 9, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3571, "recall": 0.1724, "f1": 0.2326, "f2": 0.1923, "f2_score": 19.2, "f3": 0.1818, "f3_score": 18.2, "tpr": 0.1724, "fpr": 0.6923, "youden_j": -0.5199, "cvss_coverage": 1.0, "cvss_tp_weight": 29.9, "cvss_fp_weight": 56.3, "cvss_fn_weight": 145.8, "cvss_precision": 0.347, "cvss_recall": 0.1702, "cvss_f3": 0.1793, "cvss_f3_score": 17.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 0, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-052", "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-260", "file": "app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-503", "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-513", "file": "app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/app.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "static/index.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "static/index.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-053", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-054", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-132", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-215", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-237", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-309", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-324", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-463", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-473", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-483", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-492", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-523", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-533", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-543", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-010", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] } }, "vc-codex-seeded-v2-property-management-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7308, "recall": 0.6129, "f1": 0.6667, "f2": 0.6333, "f2_score": 63.3, "f3": 0.623, "f3_score": 62.3, "tpr": 0.6129, "fpr": 0.6364, "youden_j": -0.0235, "cvss_coverage": 1.0, "cvss_tp_weight": 113.3, "cvss_fp_weight": 31.2, "cvss_fn_weight": 65.6, "cvss_precision": 0.7843, "cvss_recall": 0.6333, "cvss_f3": 0.6457, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-534", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.5484, "f1": 0.6415, "f2": 0.5822, "f2_score": 58.2, "f3": 0.5648, "f3_score": 56.5, "tpr": 0.5484, "fpr": 0.5556, "youden_j": -0.0072, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 7.1, "cvss_fn_weight": 76.9, "cvss_precision": 0.9348, "cvss_recall": 0.5702, "cvss_f3": 0.5933, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.4839, "f1": 0.5882, "f2": 0.5208, "f2_score": 52.1, "f3": 0.5017, "f3_score": 50.2, "tpr": 0.4839, "fpr": 0.5556, "youden_j": -0.0717, "cvss_coverage": 1.0, "cvss_tp_weight": 89.0, "cvss_fp_weight": 7.1, "cvss_fn_weight": 89.9, "cvss_precision": 0.926, "cvss_recall": 0.4975, "cvss_f3": 0.5216, "cvss_f3_score": 52.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7895, "recall": 0.4839, "f1": 0.6, "f2": 0.5245, "f2_score": 52.4, "f3": 0.5034, "f3_score": 50.3, "tpr": 0.4839, "fpr": 0.5, "youden_j": -0.0161, "cvss_coverage": 1.0, "cvss_tp_weight": 82.8, "cvss_fp_weight": 15.8, "cvss_fn_weight": 96.1, "cvss_precision": 0.8395, "cvss_recall": 0.4628, "cvss_f3": 0.4846, "cvss_f3_score": 48.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-173", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 15, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.5806, "f1": 0.5625, "f2": 0.5732, "f2_score": 57.3, "f3": 0.5769, "f3_score": 57.7, "tpr": 0.5806, "fpr": 0.7895, "youden_j": -0.2088, "cvss_coverage": 1.0, "cvss_tp_weight": 107.5, "cvss_fp_weight": 58.2, "cvss_fn_weight": 71.4, "cvss_precision": 0.6487, "cvss_recall": 0.6009, "cvss_f3": 0.6054, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 0, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4616, "recall": 0.1935, "f1": 0.2727, "f2": 0.219, "f2_score": 21.9, "f3": 0.2055, "f3_score": 20.6, "tpr": 0.1935, "fpr": 0.1, "youden_j": 0.0935, "cvss_coverage": 1.0, "cvss_tp_weight": 38.6, "cvss_fp_weight": 2.5, "cvss_fn_weight": 140.2, "cvss_precision": 0.469, "cvss_recall": 0.216, "cvss_f3": 0.2283, "cvss_f3_score": 22.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 178.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-057", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-173", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-356", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-484", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-504", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-524", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8512, "recall": 0.4194, "f1": 0.5614, "f2": 0.4665, "f2_score": 46.7, "f3": 0.4417, "f3_score": 44.2, "tpr": 0.4194, "fpr": 0.3444, "youden_j": 0.0749, "cvss_coverage": 1.0, "cvss_tp_weight": 78.9, "cvss_fp_weight": 5.8, "cvss_fn_weight": 100.0, "cvss_precision": 0.9315, "cvss_recall": 0.4412, "cvss_f3": 0.4657, "cvss_f3_score": 46.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7847, "recall": 0.4731, "f1": 0.5897, "f2": 0.5137, "f2_score": 51.4, "f3": 0.4926, "f3_score": 49.2, "tpr": 0.4731, "fpr": 0.5, "youden_j": -0.0269, "cvss_coverage": 1.0, "cvss_tp_weight": 90.9, "cvss_fp_weight": 11.2, "cvss_fn_weight": 88.0, "cvss_precision": 0.8899, "cvss_recall": 0.5083, "cvss_f3": 0.531, "cvss_f3_score": 53.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-173", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 12, "fp": 7, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4308, "recall": 0.3871, "f1": 0.4073, "f2": 0.3948, "f2_score": 39.5, "f3": 0.3909, "f3_score": 39.1, "tpr": 0.3871, "fpr": 0.4722, "youden_j": -0.0851, "cvss_coverage": 1.0, "cvss_tp_weight": 73.7, "cvss_fp_weight": 23.3, "cvss_fn_weight": 105.2, "cvss_precision": 0.5102, "cvss_recall": 0.4118, "cvss_f3": 0.4196, "cvss_f3_score": 42.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 10, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.5806, "f1": 0.6102, "f2": 0.5921, "f2_score": 59.2, "f3": 0.5863, "f3_score": 58.6, "tpr": 0.5806, "fpr": 0.7143, "youden_j": -0.1336, "cvss_coverage": 1.0, "cvss_tp_weight": 110.2, "cvss_fp_weight": 46.5, "cvss_fn_weight": 68.7, "cvss_precision": 0.7032, "cvss_recall": 0.616, "cvss_f3": 0.6237, "cvss_f3_score": 62.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7078, "recall": 0.4731, "f1": 0.5662, "f2": 0.5063, "f2_score": 50.6, "f3": 0.4891, "f3_score": 48.9, "tpr": 0.4731, "fpr": 0.6, "youden_j": -0.1269, "cvss_coverage": 1.0, "cvss_tp_weight": 90.7, "cvss_fp_weight": 9.1, "cvss_fn_weight": 88.2, "cvss_precision": 0.9077, "cvss_recall": 0.5072, "cvss_f3": 0.5305, "cvss_f3_score": 53.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.619, "recall": 0.4194, "f1": 0.5, "f2": 0.4483, "f2_score": 44.8, "f3": 0.4333, "f3_score": 43.3, "tpr": 0.4194, "fpr": 0.6667, "youden_j": -0.2473, "cvss_coverage": 1.0, "cvss_tp_weight": 80.0, "cvss_fp_weight": 31.7, "cvss_fn_weight": 98.9, "cvss_precision": 0.7164, "cvss_recall": 0.4472, "cvss_f3": 0.4646, "cvss_f3_score": 46.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 31, "fp": 6, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8378, "recall": 1.0, "f1": 0.9118, "f2": 0.9627, "f2_score": 96.3, "f3": 0.981, "f3_score": 98.1, "tpr": 1.0, "fpr": 0.6, "youden_j": 0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 178.9, "cvss_fp_weight": 30.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.8537, "cvss_recall": 1.0, "cvss_f3": 0.9831, "cvss_f3_score": 98.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-464", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-534", "file": "backend/app/tenant_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7222, "recall": 0.4194, "f1": 0.5306, "f2": 0.4577, "f2_score": 45.8, "f3": 0.4377, "f3_score": 43.8, "tpr": 0.4194, "fpr": 0.5556, "youden_j": -0.1362, "cvss_coverage": 1.0, "cvss_tp_weight": 82.8, "cvss_fp_weight": 11.7, "cvss_fn_weight": 96.1, "cvss_precision": 0.876, "cvss_recall": 0.4628, "cvss_f3": 0.4857, "cvss_f3_score": 48.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 17, "fp": 12, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.5484, "f1": 0.5667, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5519, "f3_score": 55.2, "tpr": 0.5484, "fpr": 0.75, "youden_j": -0.2016, "cvss_coverage": 1.0, "cvss_tp_weight": 106.7, "cvss_fp_weight": 33.7, "cvss_fn_weight": 72.2, "cvss_precision": 0.7601, "cvss_recall": 0.5964, "cvss_f3": 0.6096, "cvss_f3_score": 61.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-497" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 11, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.6129, "f1": 0.623, "f2": 0.6169, "f2_score": 61.7, "f3": 0.6149, "f3_score": 61.5, "tpr": 0.6129, "fpr": 0.7333, "youden_j": -0.1204, "cvss_coverage": 1.0, "cvss_tp_weight": 111.7, "cvss_fp_weight": 37.8, "cvss_fn_weight": 67.2, "cvss_precision": 0.7473, "cvss_recall": 0.6244, "cvss_f3": 0.6348, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 2, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8545, "recall": 0.3548, "f1": 0.4883, "f2": 0.3977, "f2_score": 39.8, "f3": 0.375, "f3_score": 37.5, "tpr": 0.3548, "fpr": 0.3, "youden_j": 0.0548, "cvss_coverage": 1.0, "cvss_tp_weight": 68.6, "cvss_fp_weight": 4.1, "cvss_fn_weight": 110.3, "cvss_precision": 0.9549, "cvss_recall": 0.3832, "cvss_f3": 0.406, "cvss_f3_score": 40.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 16, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5161, "f1": 0.5926, "f2": 0.5442, "f2_score": 54.4, "f3": 0.5298, "f3_score": 53.0, "tpr": 0.5161, "fpr": 0.6364, "youden_j": -0.1202, "cvss_coverage": 1.0, "cvss_tp_weight": 95.5, "cvss_fp_weight": 12.7, "cvss_fn_weight": 83.4, "cvss_precision": 0.8824, "cvss_recall": 0.5338, "cvss_f3": 0.5558, "cvss_f3_score": 55.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 15, "fp": 7, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6919, "recall": 0.4839, "f1": 0.5694, "f2": 0.5148, "f2_score": 51.5, "f3": 0.4989, "f3_score": 49.9, "tpr": 0.4839, "fpr": 0.6243, "youden_j": -0.1404, "cvss_coverage": 1.0, "cvss_tp_weight": 94.1, "cvss_fp_weight": 15.6, "cvss_fn_weight": 84.8, "cvss_precision": 0.8581, "cvss_recall": 0.526, "cvss_f3": 0.5471, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 7, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7083, "recall": 0.5484, "f1": 0.6182, "f2": 0.5743, "f2_score": 57.4, "f3": 0.5611, "f3_score": 56.1, "tpr": 0.5484, "fpr": 0.6364, "youden_j": -0.088, "cvss_coverage": 1.0, "cvss_tp_weight": 103.7, "cvss_fp_weight": 12.7, "cvss_fn_weight": 75.2, "cvss_precision": 0.8907, "cvss_recall": 0.5797, "cvss_f3": 0.6006, "cvss_f3_score": 60.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 14, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.4516, "f1": 0.5714, "f2": 0.493, "f2_score": 49.3, "f3": 0.4714, "f3_score": 47.1, "tpr": 0.4516, "fpr": 0.5, "youden_j": -0.0484, "cvss_coverage": 1.0, "cvss_tp_weight": 87.7, "cvss_fp_weight": 18.5, "cvss_fn_weight": 91.2, "cvss_precision": 0.8258, "cvss_recall": 0.4902, "cvss_f3": 0.511, "cvss_f3_score": 51.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 26, "fp": 46, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3611, "recall": 0.8387, "f1": 0.5049, "f2": 0.6633, "f2_score": 66.3, "f3": 0.7407, "f3_score": 74.1, "tpr": 0.8387, "fpr": 0.92, "youden_j": -0.0813, "cvss_coverage": 1.0, "cvss_tp_weight": 153.7, "cvss_fp_weight": 307.0, "cvss_fn_weight": 25.2, "cvss_precision": 0.3336, "cvss_recall": 0.8591, "cvss_f3": 0.7422, "cvss_f3_score": 74.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 14, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5882, "recall": 0.6452, "f1": 0.6154, "f2": 0.6329, "f2_score": 63.3, "f3": 0.639, "f3_score": 63.9, "tpr": 0.6452, "fpr": 0.7778, "youden_j": -0.1326, "cvss_coverage": 1.0, "cvss_tp_weight": 117.4, "cvss_fp_weight": 100.0, "cvss_fn_weight": 61.5, "cvss_precision": 0.54, "cvss_recall": 0.6562, "cvss_f3": 0.6424, "cvss_f3_score": 64.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0323, "f1": 0.0625, "f2": 0.04, "f2_score": 4.0, "f3": 0.0357, "f3_score": 3.6, "tpr": 0.0323, "fpr": 0.0, "youden_j": 0.0323, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 173.0, "cvss_precision": 1.0, "cvss_recall": 0.033, "cvss_f3": 0.0365, "cvss_f3_score": 3.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-057", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-173", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-356", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-484", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-504", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-524", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 26, "fp": 36, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4194, "recall": 0.8387, "f1": 0.5591, "f2": 0.6989, "f2_score": 69.9, "f3": 0.7625, "f3_score": 76.2, "tpr": 0.8387, "fpr": 0.9, "youden_j": -0.0613, "cvss_coverage": 1.0, "cvss_tp_weight": 148.2, "cvss_fp_weight": 224.0, "cvss_fn_weight": 30.7, "cvss_precision": 0.3982, "cvss_recall": 0.8284, "cvss_f3": 0.7476, "cvss_f3_score": 74.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8235 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 27, "fp": 17, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6136, "recall": 0.871, "f1": 0.72, "f2": 0.8036, "f2_score": 80.4, "f3": 0.8359, "f3_score": 83.6, "tpr": 0.871, "fpr": 0.8095, "youden_j": 0.0614, "cvss_coverage": 1.0, "cvss_tp_weight": 156.1, "cvss_fp_weight": 128.5, "cvss_fn_weight": 22.8, "cvss_precision": 0.5485, "cvss_recall": 0.8726, "cvss_f3": 0.8239, "cvss_f3_score": 82.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-464", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-534", "file": "backend/app/tenant_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 19, "fp": 11, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.6129, "f1": 0.623, "f2": 0.6169, "f2_score": 61.7, "f3": 0.6149, "f3_score": 61.5, "tpr": 0.6129, "fpr": 0.7333, "youden_j": -0.1204, "cvss_coverage": 1.0, "cvss_tp_weight": 110.4, "cvss_fp_weight": 60.0, "cvss_fn_weight": 68.5, "cvss_precision": 0.6479, "cvss_recall": 0.6171, "cvss_f3": 0.6201, "cvss_f3_score": 62.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 26, "fp": 43, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3768, "recall": 0.8387, "f1": 0.52, "f2": 0.6736, "f2_score": 67.4, "f3": 0.7471, "f3_score": 74.7, "tpr": 0.8387, "fpr": 0.9149, "youden_j": -0.0762, "cvss_coverage": 1.0, "cvss_tp_weight": 148.2, "cvss_fp_weight": 267.5, "cvss_fn_weight": 30.7, "cvss_precision": 0.3565, "cvss_recall": 0.8284, "cvss_f3": 0.7316, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8235 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-055", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-056", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-195", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-238", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-310", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 4, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.3011, "f1": 0.4177, "f2": 0.3386, "f2_score": 33.9, "f3": 0.3187, "f3_score": 31.9, "tpr": 0.3011, "fpr": 0.5185, "youden_j": -0.2175, "cvss_coverage": 1.0, "cvss_tp_weight": 62.8, "cvss_fp_weight": 18.9, "cvss_fn_weight": 116.1, "cvss_precision": 0.7681, "cvss_recall": 0.3512, "cvss_f3": 0.3711, "cvss_f3_score": 37.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-464", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 10, "fp": 10, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.3226, "f1": 0.3922, "f2": 0.3472, "f2_score": 34.7, "f3": 0.3344, "f3_score": 33.4, "tpr": 0.3226, "fpr": 0.7143, "youden_j": -0.3917, "cvss_coverage": 1.0, "cvss_tp_weight": 67.7, "cvss_fp_weight": 28.1, "cvss_fn_weight": 111.2, "cvss_precision": 0.707, "cvss_recall": 0.3784, "cvss_f3": 0.3969, "cvss_f3_score": 39.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-539" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-493", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 11, "fp": 8, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.3548, "f1": 0.44, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3691, "f3_score": 36.9, "tpr": 0.3548, "fpr": 0.6667, "youden_j": -0.3118, "cvss_coverage": 1.0, "cvss_tp_weight": 70.9, "cvss_fp_weight": 27.1, "cvss_fn_weight": 108.0, "cvss_precision": 0.7238, "cvss_recall": 0.3963, "cvss_f3": 0.4151, "cvss_f3_score": 41.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-474", "file": "backend/app/tenant_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-544", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "rowan": { "scanner": "rowan", "tp": 11, "fp": 30, "fn": 20, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2683, "recall": 0.3548, "f1": 0.3056, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3438, "f3_score": 34.4, "tpr": 0.3548, "fpr": 0.9091, "youden_j": -0.5543, "cvss_coverage": 1.0, "cvss_tp_weight": 69.2, "cvss_fp_weight": 143.0, "cvss_fn_weight": 109.7, "cvss_precision": 0.3261, "cvss_recall": 0.3868, "cvss_f3": 0.3797, "cvss_f3_score": 38.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 1, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 12, "recall": 0.2941 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-484", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-524", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/scripts/seed.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth_workflows.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-057", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 7, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6364, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 31.2, "cvss_fn_weight": 178.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-057", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-173", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-275", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-356", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-484", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-504", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-514", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-524", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 3, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.2258, "f1": 0.3415, "f2": 0.2612, "f2_score": 26.1, "f3": 0.2422, "f3_score": 24.2, "tpr": 0.2258, "fpr": 0.4286, "youden_j": -0.2028, "cvss_coverage": 1.0, "cvss_tp_weight": 39.7, "cvss_fp_weight": 24.1, "cvss_fn_weight": 139.2, "cvss_precision": 0.6221, "cvss_recall": 0.2219, "cvss_f3": 0.2372, "cvss_f3_score": 23.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-057", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-173", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-275", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-356", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-504", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-514", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-055", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-056", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-195", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-238", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-310", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-464", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-474", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-484", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-493", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-524", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-534", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-544", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-918" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-property-management-fastapi-enrich-013", "file": null, "cwe": "CWE-1236" } ] } }, "vc-codex-seeded-v2-support-desk-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 19, "fp": 10, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6552, "recall": 0.6333, "f1": 0.6441, "f2": 0.6376, "f2_score": 63.8, "f3": 0.6355, "f3_score": 63.5, "tpr": 0.6333, "fpr": 0.7692, "youden_j": -0.1359, "cvss_coverage": 1.0, "cvss_tp_weight": 110.8, "cvss_fp_weight": 33.6, "cvss_fn_weight": 62.9, "cvss_precision": 0.7674, "cvss_recall": 0.6379, "cvss_f3": 0.6488, "cvss_f3_score": 64.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-535", "file": "backend/app/support_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 15, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5161, "recall": 0.5333, "f1": 0.5246, "f2": 0.5298, "f2_score": 53.0, "f3": 0.5316, "f3_score": 53.2, "tpr": 0.5333, "fpr": 0.8333, "youden_j": -0.3, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 55.1, "cvss_fn_weight": 80.7, "cvss_precision": 0.6278, "cvss_recall": 0.5354, "cvss_f3": 0.5434, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 0, "fn": 16, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4667, "f1": 0.6364, "f2": 0.5224, "f2_score": 52.2, "f3": 0.493, "f3_score": 49.3, "tpr": 0.4667, "fpr": 0.0, "youden_j": 0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 80.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 93.7, "cvss_precision": 1.0, "cvss_recall": 0.4606, "cvss_f3": 0.4868, "cvss_f3_score": 48.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 4, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7647, "recall": 0.4333, "f1": 0.5532, "f2": 0.4745, "f2_score": 47.4, "f3": 0.453, "f3_score": 45.3, "tpr": 0.4333, "fpr": 0.5714, "youden_j": -0.1381, "cvss_coverage": 1.0, "cvss_tp_weight": 72.5, "cvss_fp_weight": 21.1, "cvss_fn_weight": 101.2, "cvss_precision": 0.7749, "cvss_recall": 0.4174, "cvss_f3": 0.4376, "cvss_f3_score": 43.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 11, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.5667, "f1": 0.5862, "f2": 0.5743, "f2_score": 57.4, "f3": 0.5705, "f3_score": 57.0, "tpr": 0.5667, "fpr": 0.7857, "youden_j": -0.219, "cvss_coverage": 1.0, "cvss_tp_weight": 101.2, "cvss_fp_weight": 57.9, "cvss_fn_weight": 72.5, "cvss_precision": 0.6361, "cvss_recall": 0.5826, "cvss_f3": 0.5876, "cvss_f3_score": 58.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 20, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3444, "f1": 0.511, "f2": 0.396, "f2_score": 39.6, "f3": 0.3684, "f3_score": 36.9, "tpr": 0.3444, "fpr": 0.0, "youden_j": 0.3444, "cvss_coverage": 1.0, "cvss_tp_weight": 65.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 107.8, "cvss_precision": 1.0, "cvss_recall": 0.3796, "cvss_f3": 0.4045, "cvss_f3_score": 40.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 2, "fn": 23, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.2333, "f1": 0.359, "f2": 0.2713, "f2_score": 27.1, "f3": 0.2509, "f3_score": 25.1, "tpr": 0.2333, "fpr": 0.4, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 50.3, "cvss_fp_weight": 1.0, "cvss_fn_weight": 123.4, "cvss_precision": 0.9805, "cvss_recall": 0.2896, "cvss_f3": 0.3115, "cvss_f3_score": 31.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 14, "recall": 0.0667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 11, "fp": 4, "fn": 19, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7537, "recall": 0.3778, "f1": 0.5003, "f2": 0.4185, "f2_score": 41.8, "f3": 0.3971, "f3_score": 39.7, "tpr": 0.3778, "fpr": 0.5476, "youden_j": -0.1699, "cvss_coverage": 1.0, "cvss_tp_weight": 67.9, "cvss_fp_weight": 11.4, "cvss_fn_weight": 105.8, "cvss_precision": 0.8535, "cvss_recall": 0.3911, "cvss_f3": 0.4133, "cvss_f3_score": 41.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 3, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8439, "recall": 0.5444, "f1": 0.6618, "f2": 0.586, "f2_score": 58.6, "f3": 0.5644, "f3_score": 56.5, "tpr": 0.5444, "fpr": 0.4905, "youden_j": 0.054, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 7.9, "cvss_fn_weight": 78.5, "cvss_precision": 0.9239, "cvss_recall": 0.5481, "cvss_f3": 0.5711, "cvss_f3_score": 57.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 11, "fp": 5, "fn": 19, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4674, "recall": 0.3667, "f1": 0.4094, "f2": 0.3823, "f2_score": 38.2, "f3": 0.3743, "f3_score": 37.4, "tpr": 0.3667, "fpr": 0.4524, "youden_j": -0.0857, "cvss_coverage": 1.0, "cvss_tp_weight": 65.0, "cvss_fp_weight": 10.5, "cvss_fn_weight": 108.7, "cvss_precision": 0.5766, "cvss_recall": 0.374, "cvss_f3": 0.3876, "cvss_f3_score": 38.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 7, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7083, "recall": 0.5667, "f1": 0.6296, "f2": 0.5903, "f2_score": 59.0, "f3": 0.5782, "f3_score": 57.8, "tpr": 0.5667, "fpr": 0.7, "youden_j": -0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 101.2, "cvss_fp_weight": 13.0, "cvss_fn_weight": 72.5, "cvss_precision": 0.886, "cvss_recall": 0.5826, "cvss_f3": 0.6033, "cvss_f3_score": 60.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 17, "fp": 7, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7138, "recall": 0.5666, "f1": 0.6307, "f2": 0.5905, "f2_score": 59.1, "f3": 0.5783, "f3_score": 57.8, "tpr": 0.5666, "fpr": 0.6841, "youden_j": -0.1174, "cvss_coverage": 1.0, "cvss_tp_weight": 100.9, "cvss_fp_weight": 17.6, "cvss_fn_weight": 72.8, "cvss_precision": 0.8484, "cvss_recall": 0.5809, "cvss_f3": 0.5996, "cvss_f3_score": 59.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 11, "fp": 2, "fn": 19, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8462, "recall": 0.3667, "f1": 0.5116, "f2": 0.4135, "f2_score": 41.4, "f3": 0.3887, "f3_score": 38.9, "tpr": 0.3667, "fpr": 0.4, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 71.9, "cvss_fp_weight": 1.0, "cvss_fn_weight": 101.8, "cvss_precision": 0.9863, "cvss_recall": 0.4139, "cvss_f3": 0.4394, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 8, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7037, "recall": 0.6333, "f1": 0.6667, "f2": 0.6463, "f2_score": 64.6, "f3": 0.6397, "f3_score": 64.0, "tpr": 0.6333, "fpr": 0.7273, "youden_j": -0.0939, "cvss_coverage": 1.0, "cvss_tp_weight": 108.6, "cvss_fp_weight": 23.1, "cvss_fn_weight": 65.1, "cvss_precision": 0.8249, "cvss_recall": 0.6252, "cvss_f3": 0.6407, "cvss_f3_score": 64.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 13, "fp": 6, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.4333, "f1": 0.5306, "f2": 0.4676, "f2_score": 46.8, "f3": 0.4498, "f3_score": 45.0, "tpr": 0.4333, "fpr": 0.6667, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 26.8, "cvss_fn_weight": 86.1, "cvss_precision": 0.7656, "cvss_recall": 0.5043, "cvss_f3": 0.5221, "cvss_f3_score": 52.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 7, "fn": 16, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4667, "f1": 0.549, "f2": 0.4965, "f2_score": 49.6, "f3": 0.4811, "f3_score": 48.1, "tpr": 0.4667, "fpr": 0.7, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 88.1, "cvss_fp_weight": 22.6, "cvss_fn_weight": 85.6, "cvss_precision": 0.7962, "cvss_recall": 0.5072, "cvss_f3": 0.5263, "cvss_f3_score": 52.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 30, "fp": 0, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 173.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-535", "file": "backend/app/support_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 2, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8736, "recall": 0.3889, "f1": 0.5335, "f2": 0.4358, "f2_score": 43.6, "f3": 0.411, "f3_score": 41.1, "tpr": 0.3889, "fpr": 0.2917, "youden_j": 0.0972, "cvss_coverage": 1.0, "cvss_tp_weight": 68.3, "cvss_fp_weight": 9.0, "cvss_fn_weight": 105.4, "cvss_precision": 0.8963, "cvss_recall": 0.3932, "cvss_f3": 0.4162, "cvss_f3_score": 41.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 4, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7833, "recall": 0.4166, "f1": 0.5213, "f2": 0.4509, "f2_score": 45.1, "f3": 0.4328, "f3_score": 43.2, "tpr": 0.4166, "fpr": 0.4886, "youden_j": -0.0719, "cvss_coverage": 1.0, "cvss_tp_weight": 74.5, "cvss_fp_weight": 14.2, "cvss_fn_weight": 99.2, "cvss_precision": 0.858, "cvss_recall": 0.4292, "cvss_f3": 0.4485, "cvss_f3_score": 44.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 6, "fn": 17, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6972, "recall": 0.4334, "f1": 0.5335, "f2": 0.4684, "f2_score": 46.8, "f3": 0.4502, "f3_score": 45.0, "tpr": 0.4334, "fpr": 0.646, "youden_j": -0.2127, "cvss_coverage": 1.0, "cvss_tp_weight": 80.1, "cvss_fp_weight": 7.6, "cvss_fn_weight": 93.6, "cvss_precision": 0.9152, "cvss_recall": 0.4609, "cvss_f3": 0.4848, "cvss_f3_score": 48.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 17, "fp": 5, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.5667, "f1": 0.6538, "f2": 0.5986, "f2_score": 59.9, "f3": 0.5822, "f3_score": 58.2, "tpr": 0.5667, "fpr": 0.625, "youden_j": -0.0583, "cvss_coverage": 1.0, "cvss_tp_weight": 101.2, "cvss_fp_weight": 7.3, "cvss_fn_weight": 72.5, "cvss_precision": 0.933, "cvss_recall": 0.5826, "cvss_f3": 0.6053, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 2, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.4, "f1": 0.5455, "f2": 0.4478, "f2_score": 44.8, "f3": 0.4225, "f3_score": 42.3, "tpr": 0.4, "fpr": 0.4, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 72.1, "cvss_fp_weight": 13.5, "cvss_fn_weight": 101.6, "cvss_precision": 0.8423, "cvss_recall": 0.4151, "cvss_f3": 0.4373, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 26, "fp": 51, "fn": 4, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3377, "recall": 0.8667, "f1": 0.486, "f2": 0.6599, "f2_score": 66.0, "f3": 0.7493, "f3_score": 74.9, "tpr": 0.8667, "fpr": 0.9623, "youden_j": -0.0956, "cvss_coverage": 1.0, "cvss_tp_weight": 147.3, "cvss_fp_weight": 344.5, "cvss_fn_weight": 26.4, "cvss_precision": 0.2995, "cvss_recall": 0.848, "cvss_f3": 0.7168, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 2, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 2, "recall": 0.8667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1391" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/authz.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 24, "fp": 26, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.8, "f1": 0.6, "f2": 0.7059, "f2_score": 70.6, "f3": 0.75, "f3_score": 75.0, "tpr": 0.8, "fpr": 0.9286, "youden_j": -0.1286, "cvss_coverage": 1.0, "cvss_tp_weight": 137.1, "cvss_fp_weight": 153.5, "cvss_fn_weight": 36.6, "cvss_precision": 0.4718, "cvss_recall": 0.7893, "cvss_f3": 0.7395, "cvss_f3_score": 74.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 3, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 29, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0333, "f1": 0.0645, "f2": 0.0413, "f2_score": 4.1, "f3": 0.0369, "f3_score": 3.7, "tpr": 0.0333, "fpr": 0.0, "youden_j": 0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 5.9, "cvss_fp_weight": 0.0, "cvss_fn_weight": 167.8, "cvss_precision": 1.0, "cvss_recall": 0.034, "cvss_f3": 0.0376, "cvss_f3_score": 3.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 23, "fp": 34, "fn": 7, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4035, "recall": 0.7667, "f1": 0.5287, "f2": 0.6497, "f2_score": 65.0, "f3": 0.7034, "f3_score": 70.3, "tpr": 0.7667, "fpr": 0.9189, "youden_j": -0.1523, "cvss_coverage": 1.0, "cvss_tp_weight": 131.4, "cvss_fp_weight": 218.5, "cvss_fn_weight": 42.3, "cvss_precision": 0.3755, "cvss_recall": 0.7565, "cvss_f3": 0.6868, "cvss_f3_score": 68.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 5, "recall": 0.6667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1393" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 10, "fn": 6, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.8, "f1": 0.75, "f2": 0.7792, "f2_score": 77.9, "f3": 0.7895, "f3_score": 78.9, "tpr": 0.8, "fpr": 0.8333, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 138.6, "cvss_fp_weight": 72.5, "cvss_fn_weight": 35.1, "cvss_precision": 0.6566, "cvss_recall": 0.7979, "cvss_f3": 0.7811, "cvss_f3_score": 78.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 3, "recall": 0.75 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-535", "file": "backend/app/support_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-1022" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 7, "fn": 14, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5333, "f1": 0.6038, "f2": 0.5594, "f2_score": 55.9, "f3": 0.5461, "f3_score": 54.6, "tpr": 0.5333, "fpr": 0.7, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 96.1, "cvss_fp_weight": 39.0, "cvss_fn_weight": 77.6, "cvss_precision": 0.7113, "cvss_recall": 0.5533, "cvss_f3": 0.5658, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-311", "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 24, "fp": 43, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3582, "recall": 0.8, "f1": 0.4948, "f2": 0.6417, "f2_score": 64.2, "f3": 0.7122, "f3_score": 71.2, "tpr": 0.8, "fpr": 0.9348, "youden_j": -0.1348, "cvss_coverage": 1.0, "cvss_tp_weight": 135.7, "cvss_fp_weight": 273.0, "cvss_fn_weight": 38.0, "cvss_precision": 0.332, "cvss_recall": 0.7812, "cvss_f3": 0.6881, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/alembic.ini", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1393" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-060", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-059", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-196", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-349", "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-475", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-525", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 4, "fp": 6, "fn": 26, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4167, "recall": 0.1444, "f1": 0.2137, "f2": 0.1659, "f2_score": 16.6, "f3": 0.1544, "f3_score": 15.4, "tpr": 0.1444, "fpr": 0.6314, "youden_j": -0.487, "cvss_coverage": 1.0, "cvss_tp_weight": 31.0, "cvss_fp_weight": 20.5, "cvss_fn_weight": 142.7, "cvss_precision": 0.541, "cvss_recall": 0.1785, "cvss_f3": 0.1911, "cvss_f3_score": 19.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/support_operations.py", "cwe": "CWE-644" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 12, "fp": 16, "fn": 18, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.4, "f1": 0.4138, "f2": 0.4054, "f2_score": 40.5, "f3": 0.4027, "f3_score": 40.3, "tpr": 0.4, "fpr": 0.8889, "youden_j": -0.4889, "cvss_coverage": 1.0, "cvss_tp_weight": 73.3, "cvss_fp_weight": 60.4, "cvss_fn_weight": 100.4, "cvss_precision": 0.5482, "cvss_recall": 0.422, "cvss_f3": 0.4319, "cvss_f3_score": 43.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 1, "fn": 7, "recall": 0.4167 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-058", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-500", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-545", "file": "backend/app/support_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-219", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-465", "file": "backend/app/support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": "backend/app/main.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 18, "fn": 30, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8571, "youden_j": -0.8571, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 85.2, "cvss_fn_weight": 173.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "security.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "security.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "security.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 7, "fp": 20, "fn": 23, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2593, "recall": 0.2333, "f1": 0.2456, "f2": 0.2381, "f2_score": 23.8, "f3": 0.2357, "f3_score": 23.6, "tpr": 0.2333, "fpr": 0.9091, "youden_j": -0.6758, "cvss_coverage": 1.0, "cvss_tp_weight": 42.0, "cvss_fp_weight": 104.0, "cvss_fn_weight": 131.7, "cvss_precision": 0.2877, "cvss_recall": 0.2418, "cvss_f3": 0.2457, "cvss_f3_score": 24.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 1, "fn": 11, "recall": 0.0833 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-485", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_authz_workflow.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/security.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 1, "fn": 30, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.25, "youden_j": -0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.5, "cvss_fn_weight": 173.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-codex-seeded-v2-support-desk-fastapi/backend/app/security.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-153", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-276", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-505", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-515", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 6, "fn": 25, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4545, "recall": 0.1667, "f1": 0.2439, "f2": 0.1908, "f2_score": 19.1, "f3": 0.1779, "f3_score": 17.8, "tpr": 0.1667, "fpr": 0.6667, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 24.4, "cvss_fp_weight": 40.1, "cvss_fn_weight": 149.3, "cvss_precision": 0.3786, "cvss_recall": 0.1405, "cvss_f3": 0.1499, "cvss_f3_score": 15.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/security.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-153", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-276", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-505", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-515", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/main.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-058", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-059", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-060", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-196", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-219", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-311", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-349", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-465", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-475", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-485", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-500", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-525", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-535", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-545", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-enrich-012", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-codex-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-639" } ] } }, "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 10, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4737, "recall": 0.4091, "f1": 0.439, "f2": 0.4206, "f2_score": 42.1, "f3": 0.4147, "f3_score": 41.5, "tpr": 0.4091, "fpr": 1.0, "youden_j": -0.5909, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 52.2, "cvss_fn_weight": 71.2, "cvss_precision": 0.5137, "cvss_recall": 0.4363, "cvss_f3": 0.4429, "cvss_f3_score": 44.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/user.entity.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/user.entity.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 6, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.4545, "f1": 0.5263, "f2": 0.4808, "f2_score": 48.1, "f3": 0.4673, "f3_score": 46.7, "tpr": 0.4545, "fpr": 1.0, "youden_j": -0.5455, "cvss_coverage": 1.0, "cvss_tp_weight": 64.2, "cvss_fp_weight": 24.0, "cvss_fn_weight": 62.1, "cvss_precision": 0.7282, "cvss_recall": 0.5083, "cvss_f3": 0.5241, "cvss_f3_score": 52.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 28, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3, "recall": 0.5455, "f1": 0.3871, "f2": 0.4688, "f2_score": 46.9, "f3": 0.5042, "f3_score": 50.4, "tpr": 0.5455, "fpr": 1.0, "youden_j": -0.4545, "cvss_coverage": 1.0, "cvss_tp_weight": 77.2, "cvss_fp_weight": 108.3, "cvss_fn_weight": 49.1, "cvss_precision": 0.4161, "cvss_recall": 0.6112, "cvss_f3": 0.5839, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.2 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/main.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/modules/seed/seed.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/seed/seed.service.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 11, "fp": 21, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3438, "recall": 0.5, "f1": 0.4074, "f2": 0.4583, "f2_score": 45.8, "f3": 0.4783, "f3_score": 47.8, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 65.8, "cvss_fp_weight": 120.6, "cvss_fn_weight": 60.5, "cvss_precision": 0.3531, "cvss_recall": 0.521, "cvss_f3": 0.4973, "cvss_f3_score": 49.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/modules/audit-log/audit-log.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 14, "fp": 59, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1918, "recall": 0.6364, "f1": 0.2947, "f2": 0.4348, "f2_score": 43.5, "f3": 0.5166, "f3_score": 51.7, "tpr": 0.6364, "fpr": 1.0, "youden_j": -0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 85.8, "cvss_fp_weight": 317.8, "cvss_fn_weight": 40.5, "cvss_precision": 0.2126, "cvss_recall": 0.6793, "cvss_f3": 0.5571, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/app.config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/strategies/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/strategies/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/main.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-340" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/modules/audit-log/audit-log.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 20, "fp": 15, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.9091, "f1": 0.7018, "f2": 0.813, "f2_score": 81.3, "f3": 0.8584, "f3_score": 85.8, "tpr": 0.9091, "fpr": 1.0, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 117.1, "cvss_fp_weight": 86.1, "cvss_fn_weight": 9.2, "cvss_precision": 0.5762, "cvss_recall": 0.9272, "cvss_f3": 0.8739, "cvss_f3_score": 87.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 1, "recall": 0.9412 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/modules/audit-log/audit-log.service.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/modules/seed/seed.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 31, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3404, "recall": 0.7273, "f1": 0.4638, "f2": 0.5926, "f2_score": 59.3, "f3": 0.6531, "f3_score": 65.3, "tpr": 0.7273, "fpr": 1.0, "youden_j": -0.2727, "cvss_coverage": 1.0, "cvss_tp_weight": 93.3, "cvss_fp_weight": 172.7, "cvss_fn_weight": 33.0, "cvss_precision": 0.3507, "cvss_recall": 0.7387, "cvss_f3": 0.6651, "cvss_f3_score": 66.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 4, "recall": 0.7647 }, "medium": { "tp": 3, "fp": 0, "fn": 2, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/user.entity.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/modules/seed/seed.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/strategies/jwt.strategy.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 21, "fp": 21, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.9545, "f1": 0.6562, "f2": 0.8077, "f2_score": 80.8, "f3": 0.875, "f3_score": 87.5, "tpr": 0.9545, "fpr": 1.0, "youden_j": -0.0455, "cvss_coverage": 1.0, "cvss_tp_weight": 119.8, "cvss_fp_weight": 115.3, "cvss_fn_weight": 6.5, "cvss_precision": 0.5095, "cvss_recall": 0.9485, "cvss_f3": 0.8733, "cvss_f3_score": 87.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 1, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/modules/audit-log/audit-log.service.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/modules/seed/seed.service.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 20, "fp": 37, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3509, "recall": 0.9091, "f1": 0.5063, "f2": 0.6897, "f2_score": 69.0, "f3": 0.7843, "f3_score": 78.4, "tpr": 0.9091, "fpr": 1.0, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 116.1, "cvss_fp_weight": 282.5, "cvss_fn_weight": 10.2, "cvss_precision": 0.2913, "cvss_recall": 0.9192, "cvss_f3": 0.7562, "cvss_f3_score": 75.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/interceptors/audit-log.interceptor.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/audit-log/audit-log.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/audit-log/audit-log.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/modules/audit-log/audit-log.service.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/workspace-access/workspace-access.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/contacts/contacts.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/config/app.config.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 10, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.0909, "f1": 0.1176, "f2": 0.1, "f2_score": 10.0, "f3": 0.0952, "f3_score": 9.5, "tpr": 0.0909, "fpr": 1.0, "youden_j": -0.9091, "cvss_coverage": 1.0, "cvss_tp_weight": 15.3, "cvss_fp_weight": 57.4, "cvss_fn_weight": 111.0, "cvss_precision": 0.2104, "cvss_recall": 0.1211, "cvss_f3": 0.1265, "cvss_f3_score": 12.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 10, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4118, "recall": 0.25, "f1": 0.3111, "f2": 0.2713, "f2_score": 27.1, "f3": 0.2602, "f3_score": 26.0, "tpr": 0.25, "fpr": 1.0, "youden_j": -0.75, "cvss_coverage": 1.0, "cvss_tp_weight": 47.2, "cvss_fp_weight": 60.3, "cvss_fn_weight": 121.6, "cvss_precision": 0.4391, "cvss_recall": 0.2796, "cvss_f3": 0.2902, "cvss_f3_score": 29.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 19, "recall": 0.24 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/general-upload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": "src/lib/password-reset.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/sis-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity-link.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-918" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 13, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4348, "recall": 0.3571, "f1": 0.3922, "f2": 0.3704, "f2_score": 37.0, "f3": 0.3636, "f3_score": 36.4, "tpr": 0.3571, "fpr": 1.0, "youden_j": -0.6429, "cvss_coverage": 1.0, "cvss_tp_weight": 67.6, "cvss_fp_weight": 67.3, "cvss_fn_weight": 101.2, "cvss_precision": 0.5011, "cvss_recall": 0.4005, "cvss_f3": 0.4087, "cvss_f3_score": 40.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 16, "recall": 0.36 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/sis-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity-link.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 10, "fp": 6, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.3571, "f1": 0.4545, "f2": 0.3906, "f2_score": 39.1, "f3": 0.3731, "f3_score": 37.3, "tpr": 0.3571, "fpr": 1.0, "youden_j": -0.6429, "cvss_coverage": 1.0, "cvss_tp_weight": 65.9, "cvss_fp_weight": 36.2, "cvss_fn_weight": 102.9, "cvss_precision": 0.6456, "cvss_recall": 0.3904, "cvss_f3": 0.4065, "cvss_f3_score": 40.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 16, "recall": 0.36 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity-link.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 14, "fp": 14, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5, "f1": 0.5, "f2": 0.5, "f2_score": 50.0, "f3": 0.5, "f3_score": 50.0, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 92.2, "cvss_fp_weight": 73.3, "cvss_fn_weight": 76.6, "cvss_precision": 0.557, "cvss_recall": 0.5462, "cvss_f3": 0.5473, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 12, "recall": 0.52 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity-link.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": "src/lib/extensions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/preferences-store.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/utils.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-preview.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 16, "fp": 20, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.5714, "f1": 0.5, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 102.1, "cvss_fp_weight": 87.4, "cvss_fn_weight": 66.7, "cvss_precision": 0.5388, "cvss_recall": 0.6049, "cvss_f3": 0.5975, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 11, "recall": 0.56 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": "src/lib/extensions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/discussions/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity-link.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/users/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/instructor/assignments/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-preview.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-preview.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/sis-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 17, "fp": 19, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4722, "recall": 0.6071, "f1": 0.5312, "f2": 0.5743, "f2_score": 57.4, "f3": 0.5903, "f3_score": 59.0, "tpr": 0.6071, "fpr": 1.0, "youden_j": -0.3929, "cvss_coverage": 1.0, "cvss_tp_weight": 106.5, "cvss_fp_weight": 114.5, "cvss_fn_weight": 62.3, "cvss_precision": 0.4818, "cvss_recall": 0.6309, "cvss_f3": 0.612, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 10, "recall": 0.6 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/submission-form.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": "src/lib/extensions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/webhook-dispatch.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/discussions/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/instructor/assignments/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/admin/users/[id]/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 20, "fp": 29, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4082, "recall": 0.7143, "f1": 0.5195, "f2": 0.6211, "f2_score": 62.1, "f3": 0.6645, "f3_score": 66.4, "tpr": 0.7143, "fpr": 1.0, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 122.8, "cvss_fp_weight": 174.8, "cvss_fn_weight": 46.0, "cvss_precision": 0.4126, "cvss_recall": 0.7275, "cvss_f3": 0.6759, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 7, "recall": 0.72 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/webhook-dispatch.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/instructor/assignments/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": "src/lib/extensions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/assignments/visibility/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/discussions/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/discussions/page.tsx", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/page.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": "src/lib/password-reset.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/users/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/submission-form.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": "src/app/student/assignments/[id]/submission-form.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/sis-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/login/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/preferences-store.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/admin/users/[id]/page.tsx", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/reset-password/confirm/route.ts", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 10, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 1.0, "f1": 0.8485, "f2": 0.9333, "f2_score": 93.3, "f3": 0.9655, "f3_score": 96.6, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 168.8, "cvss_fp_weight": 60.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.7368, "cvss_recall": 1.0, "cvss_f3": 0.9655, "cvss_f3_score": 96.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": "src/app/api/admin/users/[id]/route.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/instructor/assignments/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/student/appeals/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": "src/app/student/assignments/[id]/submission-form.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": "src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": "src/lib/extensions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": "src/lib/password-reset.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": "src/lib/resource-cache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/discussions/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/student/assignments/[id]/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/webhook-dispatch.ts", "cwe": "CWE-918" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 26, "fp": 23, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5306, "recall": 0.9286, "f1": 0.6753, "f2": 0.8075, "f2_score": 80.7, "f3": 0.8638, "f3_score": 86.4, "tpr": 0.9286, "fpr": 1.0, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 158.6, "cvss_fp_weight": 174.0, "cvss_fn_weight": 10.2, "cvss_precision": 0.4768, "cvss_recall": 0.9396, "cvss_f3": 0.8565, "cvss_f3_score": 85.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 2, "recall": 0.92 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/api-keys/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": "src/app/api/admin/users/[id]/route.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/register/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": "src/app/api/discussions/comments/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": "src/app/api/download/[category]/[filename]/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/assignments/extensions/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/rubric-export/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": "src/app/api/student/appeals/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/discussions/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": "src/app/student/assignments/[id]/submission-form.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": "src/lib/activity-log.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": "src/lib/export-diagnostics.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/general-upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": "src/lib/password-reset.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/password-reset.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-archive.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": "src/lib/resource-cache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": "src/lib/resource-cache.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": "src/lib/sis-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": "src/app/api/instructor/assignments/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/users/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-preview.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-preview.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": "src/lib/password-reset.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/users/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": "src/lib/password-reset.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": "src/lib/appeal-state.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 18, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 0.1071, "f1": 0.1224, "f2": 0.1128, "f2_score": 11.3, "f3": 0.1099, "f3_score": 11.0, "tpr": 0.1071, "fpr": 1.0, "youden_j": -0.8929, "cvss_coverage": 1.0, "cvss_tp_weight": 21.8, "cvss_fp_weight": 108.5, "cvss_fn_weight": 147.0, "cvss_precision": 0.1673, "cvss_recall": 0.1291, "cvss_f3": 0.1322, "cvss_f3_score": 13.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 23, "recall": 0.08 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/instructor/resources/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/student/submissions/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/appeal-state.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-020", "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/general-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-024", "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-convert.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-027", "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-convert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/resource-convert.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/roster-cache.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 14, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.3182, "f1": 0.3256, "f2": 0.3211, "f2_score": 32.1, "f3": 0.3196, "f3_score": 32.0, "tpr": 0.3182, "fpr": 1.0, "youden_j": -0.6818, "cvss_coverage": 1.0, "cvss_tp_weight": 46.1, "cvss_fp_weight": 82.5, "cvss_fn_weight": 83.6, "cvss_precision": 0.3584, "cvss_recall": 0.3554, "cvss_f3": 0.3557, "cvss_f3_score": 35.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-696" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 10, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4118, "recall": 0.3182, "f1": 0.359, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3256, "f3_score": 32.6, "tpr": 0.3182, "fpr": 1.0, "youden_j": -0.6818, "cvss_coverage": 1.0, "cvss_tp_weight": 51.4, "cvss_fp_weight": 59.0, "cvss_fn_weight": 78.3, "cvss_precision": 0.4658, "cvss_recall": 0.3963, "cvss_f3": 0.4023, "cvss_f3_score": 40.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.1538 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": "backend/src/routes/imports.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 12, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.3182, "f1": 0.3415, "f2": 0.3271, "f2_score": 32.7, "f3": 0.3226, "f3_score": 32.3, "tpr": 0.3182, "fpr": 1.0, "youden_j": -0.6818, "cvss_coverage": 1.0, "cvss_tp_weight": 48.6, "cvss_fp_weight": 54.6, "cvss_fn_weight": 81.1, "cvss_precision": 0.4711, "cvss_recall": 0.3747, "cvss_f3": 0.3825, "cvss_f3_score": 38.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 10, "fp": 13, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4348, "recall": 0.4545, "f1": 0.4444, "f2": 0.4505, "f2_score": 45.0, "f3": 0.4525, "f3_score": 45.2, "tpr": 0.4545, "fpr": 1.0, "youden_j": -0.5455, "cvss_coverage": 1.0, "cvss_tp_weight": 69.6, "cvss_fp_weight": 71.2, "cvss_fn_weight": 60.1, "cvss_precision": 0.4942, "cvss_recall": 0.5366, "cvss_f3": 0.5321, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3846 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/data-source.ts", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 11, "fp": 34, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2444, "recall": 0.5, "f1": 0.3284, "f2": 0.4135, "f2_score": 41.4, "f3": 0.4527, "f3_score": 45.3, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 76.4, "cvss_fp_weight": 173.5, "cvss_fn_weight": 53.3, "cvss_precision": 0.3058, "cvss_recall": 0.5891, "cvss_f3": 0.5391, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3846 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 10, "recall": 0.5238 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 15, "fp": 31, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3261, "recall": 0.6818, "f1": 0.4412, "f2": 0.5597, "f2_score": 56.0, "f3": 0.6148, "f3_score": 61.5, "tpr": 0.6818, "fpr": 1.0, "youden_j": -0.3182, "cvss_coverage": 1.0, "cvss_tp_weight": 94.5, "cvss_fp_weight": 182.8, "cvss_fn_weight": 35.2, "cvss_precision": 0.3408, "cvss_recall": 0.7286, "cvss_f3": 0.6542, "cvss_f3_score": 65.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6154 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 6, "recall": 0.7143 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notes.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": "backend/src/routes/imports.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 26, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.35, "recall": 0.6364, "f1": 0.4516, "f2": 0.5469, "f2_score": 54.7, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.6364, "fpr": 1.0, "youden_j": -0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 153.3, "cvss_fn_weight": 36.7, "cvss_precision": 0.3776, "cvss_recall": 0.717, "cvss_f3": 0.6579, "cvss_f3_score": 65.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6923 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 8, "recall": 0.619 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": "backend/src/routes/decisions.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-772" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 12, "fp": 35, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2553, "recall": 0.5455, "f1": 0.3478, "f2": 0.4444, "f2_score": 44.4, "f3": 0.4898, "f3_score": 49.0, "tpr": 0.5455, "fpr": 1.0, "youden_j": -0.4545, "cvss_coverage": 1.0, "cvss_tp_weight": 78.4, "cvss_fp_weight": 206.3, "cvss_fn_weight": 51.3, "cvss_precision": 0.2753, "cvss_recall": 0.6045, "cvss_f3": 0.5399, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4615 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 9, "recall": 0.5714 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notes.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 20, "fp": 34, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3704, "recall": 0.9091, "f1": 0.5263, "f2": 0.7042, "f2_score": 70.4, "f3": 0.7937, "f3_score": 79.4, "tpr": 0.9091, "fpr": 1.0, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 118.6, "cvss_fp_weight": 249.5, "cvss_fn_weight": 11.1, "cvss_precision": 0.3222, "cvss_recall": 0.9144, "cvss_f3": 0.7724, "cvss_f3_score": 77.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 2, "recall": 0.9048 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": "backend/src/routes/admin.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": "backend/src/routes/admin.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": "backend/src/routes/applications.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": "backend/src/utils/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": "backend/src/utils/core-banking.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/email.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": "backend/src/routes/decisions.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 55, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0517, "recall": 0.1364, "f1": 0.075, "f2": 0.1027, "f2_score": 10.3, "f3": 0.1172, "f3_score": 11.7, "tpr": 0.1364, "fpr": 1.0, "youden_j": -0.8636, "cvss_coverage": 1.0, "cvss_tp_weight": 18.8, "cvss_fp_weight": 313.5, "cvss_fn_weight": 110.9, "cvss_precision": 0.0566, "cvss_recall": 0.1449, "cvss_f3": 0.1254, "cvss_f3_score": 12.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 18, "recall": 0.1429 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/applications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-009", "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/borrowers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/decisions.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-012", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payment-accounts.ts", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 12, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.2917, "f1": 0.3256, "f2": 0.3043, "f2_score": 30.4, "f3": 0.2979, "f3_score": 29.8, "tpr": 0.2917, "fpr": 1.0, "youden_j": -0.7083, "cvss_coverage": 1.0, "cvss_tp_weight": 55.4, "cvss_fp_weight": 65.1, "cvss_fn_weight": 85.6, "cvss_precision": 0.4597, "cvss_recall": 0.3929, "cvss_f3": 0.3987, "cvss_f3_score": 39.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 17, "recall": 0.2917 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/scheduleSync.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageDrafting.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicRuntimeConfig.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 11, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.45, "recall": 0.375, "f1": 0.4091, "f2": 0.3879, "f2_score": 38.8, "f3": 0.3814, "f3_score": 38.1, "tpr": 0.375, "fpr": 1.0, "youden_j": -0.625, "cvss_coverage": 1.0, "cvss_tp_weight": 66.2, "cvss_fp_weight": 59.2, "cvss_fn_weight": 74.8, "cvss_precision": 0.5277, "cvss_recall": 0.4695, "cvss_f3": 0.4747, "cvss_f3_score": 47.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 15, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/scheduleSync.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/lib/clinicBranding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/workspace-preferences/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/workspace-preferences/route.ts", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 9, "fp": 15, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.375, "f1": 0.375, "f2": 0.375, "f2_score": 37.5, "f3": 0.375, "f3_score": 37.5, "tpr": 0.375, "fpr": 1.0, "youden_j": -0.625, "cvss_coverage": 1.0, "cvss_tp_weight": 65.6, "cvss_fp_weight": 72.0, "cvss_fn_weight": 75.4, "cvss_precision": 0.4767, "cvss_recall": 0.4652, "cvss_f3": 0.4664, "cvss_f3_score": 46.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 15, "recall": 0.375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/scheduleSync.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicRuntimeConfig.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 12, "fp": 15, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.5, "f1": 0.4706, "f2": 0.4878, "f2_score": 48.8, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 78.3, "cvss_fp_weight": 88.1, "cvss_fn_weight": 62.7, "cvss_precision": 0.4705, "cvss_recall": 0.5553, "cvss_f3": 0.5455, "cvss_f3_score": 54.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 12, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/scheduleSync.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicRuntimeConfig.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkinGate.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/counter-session/route.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/counter-session/route.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/kioskSession.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/kioskSession.ts", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 14, "fp": 22, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 0.5833, "f1": 0.4667, "f2": 0.5303, "f2_score": 53.0, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5833, "fpr": 1.0, "youden_j": -0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 89.0, "cvss_fp_weight": 123.9, "cvss_fn_weight": 52.0, "cvss_precision": 0.4181, "cvss_recall": 0.6312, "cvss_f3": 0.6006, "cvss_f3_score": 60.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 10, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/lib/clinicBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/email-link/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/email-link/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/portal-link/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/portal-link/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/import/route.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicRuntimeConfig.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkinGate.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/draft-reply/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageDrafting.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/kioskSession.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/insurance.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 15, "fp": 31, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3261, "recall": 0.625, "f1": 0.4286, "f2": 0.5282, "f2_score": 52.8, "f3": 0.5725, "f3_score": 57.3, "tpr": 0.625, "fpr": 1.0, "youden_j": -0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 94.5, "cvss_fp_weight": 182.1, "cvss_fn_weight": 46.5, "cvss_precision": 0.3416, "cvss_recall": 0.6702, "cvss_f3": 0.6114, "cvss_f3_score": 61.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 9, "recall": 0.625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkinGate.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": "src/app/api/prescriptions/[id]/refill-draft/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/lib/clinicBranding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/lib/insurance.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/insurance.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/import/route.ts", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/admin/users/page.tsx", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/counter-session/route.ts", "cwe": "CWE-288" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visit-summary-access.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/handout/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/appointments/[id]/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/messages/[id]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/comments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/draft-reply/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/visit-summaries/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/visit-summaries/[id]/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 10, "fp": 29, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2564, "recall": 0.4167, "f1": 0.3175, "f2": 0.3704, "f2_score": 37.0, "f3": 0.3922, "f3_score": 39.2, "tpr": 0.4167, "fpr": 1.0, "youden_j": -0.5833, "cvss_coverage": 1.0, "cvss_tp_weight": 62.5, "cvss_fp_weight": 170.4, "cvss_fn_weight": 78.5, "cvss_precision": 0.2684, "cvss_recall": 0.4433, "cvss_f3": 0.4161, "cvss_f3_score": 41.6, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 14, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visit-summary-access.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/prescriptions/new/page.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/handoff-note/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/layout.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/admin/users/page.tsx", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/lib/insurance.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/insurance.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/workspace-preferences/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/login/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 21, "fp": 14, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.875, "f1": 0.7119, "f2": 0.8015, "f2_score": 80.2, "f3": 0.8367, "f3_score": 83.7, "tpr": 0.875, "fpr": 1.0, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 122.3, "cvss_fp_weight": 82.2, "cvss_fn_weight": 18.7, "cvss_precision": 0.5979, "cvss_recall": 0.8674, "cvss_f3": 0.83, "cvss_f3_score": 83.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 3, "recall": 0.875 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": "src/app/api/prescriptions/[id]/refill-draft/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/lib/careTeam.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/lib/clinicBranding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/lib/insurance.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/kioskSession.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/kioskSession.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/visitLinks.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/checkinGate.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/import/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/layout.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/route.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 21, "fp": 27, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.875, "f1": 0.5833, "f2": 0.7292, "f2_score": 72.9, "f3": 0.7955, "f3_score": 79.5, "tpr": 0.875, "fpr": 1.0, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 122.3, "cvss_fp_weight": 207.5, "cvss_fn_weight": 18.7, "cvss_precision": 0.3708, "cvss_recall": 0.8674, "cvss_f3": 0.7649, "cvss_f3_score": 76.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 3, "recall": 0.875 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/clinicians/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/import/route.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/login/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/route.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": "src/app/api/prescriptions/[id]/refill-draft/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/lib/careTeam.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/lib/clinicBranding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicRuntimeConfig.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/lib/errors.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/lib/insurance.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/intakeForms.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/labResultsSync.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/reportEngine.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/scheduleSync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/integrationKeys.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/kioskSession.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/kioskSession.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/route.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/api/clinicians/kiosk-specialty/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/visit-summaries/email-link/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 18, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 0.125, "f1": 0.1333, "f2": 0.1282, "f2_score": 12.8, "f3": 0.1266, "f3_score": 12.7, "tpr": 0.125, "fpr": 1.0, "youden_j": -0.875, "cvss_coverage": 1.0, "cvss_tp_weight": 18.8, "cvss_fp_weight": 100.4, "cvss_fn_weight": 122.2, "cvss_precision": 0.1578, "cvss_recall": 0.1333, "cvss_f3": 0.1354, "cvss_f3_score": 13.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 21, "recall": 0.125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/admin/import-export/page.tsx", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/staff-directory/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-002", "file": "src/app/api/appointments/sync/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clinicBranding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentConversion.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentConversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentConversion.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentTemplates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/file-upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/intakeForms.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reviewDrafts.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-784" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-784" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 11, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.45, "recall": 0.5, "f1": 0.4737, "f2": 0.4891, "f2_score": 48.9, "f3": 0.4945, "f3_score": 49.5, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 52.2, "cvss_fp_weight": 66.2, "cvss_fn_weight": 66.1, "cvss_precision": 0.4408, "cvss_recall": 0.4413, "cvss_f3": 0.4412, "cvss_f3_score": 44.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": "app/routes/compensation.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 22, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.2414, "recall": 0.3889, "f1": 0.2979, "f2": 0.3465, "f2_score": 34.7, "f3": 0.3665, "f3_score": 36.6, "tpr": 0.3889, "fpr": 1.0, "youden_j": -0.6111, "cvss_coverage": 1.0, "cvss_tp_weight": 43.0, "cvss_fp_weight": 132.4, "cvss_fn_weight": 75.3, "cvss_precision": 0.2451, "cvss_recall": 0.3635, "cvss_f3": 0.3467, "cvss_f3_score": 34.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.3 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 11, "recall": 0.3529 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/import-export.tsx", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": "app/routes/compensation.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 10, "fp": 15, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.4, "recall": 0.5556, "f1": 0.4651, "f2": 0.5155, "f2_score": 51.5, "f3": 0.5348, "f3_score": 53.5, "tpr": 0.5556, "fpr": 1.0, "youden_j": -0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 63.2, "cvss_fp_weight": 86.4, "cvss_fn_weight": 55.1, "cvss_precision": 0.4224, "cvss_recall": 0.5342, "cvss_f3": 0.5204, "cvss_f3_score": 52.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": "app/routes/profile.tsx", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": "app/utils/db.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 14, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.3636, "recall": 0.4444, "f1": 0.4, "f2": 0.4255, "f2_score": 42.6, "f3": 0.4348, "f3_score": 43.5, "tpr": 0.4444, "fpr": 1.0, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 46.9, "cvss_fp_weight": 92.0, "cvss_fn_weight": 71.4, "cvss_precision": 0.3376, "cvss_recall": 0.3964, "cvss_f3": 0.3897, "cvss_f3_score": 39.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/shiftCoverage.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 9, "fp": 23, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.2812, "recall": 0.5, "f1": 0.36, "f2": 0.4327, "f2_score": 43.3, "f3": 0.4639, "f3_score": 46.4, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 57.7, "cvss_fp_weight": 145.1, "cvss_fn_weight": 60.6, "cvss_precision": 0.2845, "cvss_recall": 0.4877, "cvss_f3": 0.4552, "cvss_f3_score": 45.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/shiftCoverage.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/shiftCoverage.server.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryActivity.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/directory.$id.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": "app/utils/db.server.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 18, "fp": 18, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.5, "recall": 1.0, "f1": 0.6667, "f2": 0.8333, "f2_score": 83.3, "f3": 0.9091, "f3_score": 90.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 118.3, "cvss_fp_weight": 118.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.5, "cvss_recall": 1.0, "cvss_f3": 0.9091, "cvss_f3_score": 90.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": "app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": "app/routes/compensation.tsx", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": "app/routes/onboarding.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": "app/routes/profile.tsx", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": "app/utils/activity-logger.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": "app/utils/db.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": "app/utils/session.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 10, "fp": 31, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.2439, "recall": 0.5556, "f1": 0.339, "f2": 0.4425, "f2_score": 44.2, "f3": 0.4926, "f3_score": 49.3, "tpr": 0.5556, "fpr": 1.0, "youden_j": -0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 59.8, "cvss_fp_weight": 191.6, "cvss_fn_weight": 58.5, "cvss_precision": 0.2379, "cvss_recall": 0.5055, "cvss_f3": 0.4544, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": "app/utils/session.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/dashboard.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-407" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-488" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": "app/routes/compensation.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryActivity.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/import-export.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/directory.$id.tsx", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 11, "fp": 30, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.2683, "recall": 0.6111, "f1": 0.3729, "f2": 0.4867, "f2_score": 48.7, "f3": 0.5419, "f3_score": 54.2, "tpr": 0.6111, "fpr": 1.0, "youden_j": -0.3889, "cvss_coverage": 1.0, "cvss_tp_weight": 69.5, "cvss_fp_weight": 191.1, "cvss_fn_weight": 48.8, "cvss_precision": 0.2667, "cvss_recall": 0.5875, "cvss_f3": 0.5244, "cvss_f3_score": 52.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.server.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/corp-directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryActivity.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": "app/routes/onboarding.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/timeclock.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/directory.$id.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": "app/routes/compensation.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": "app/routes/compensation.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/import-export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": "app/utils/db.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.tsx", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 15, "fp": 22, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.4054, "recall": 0.8333, "f1": 0.5455, "f2": 0.6881, "f2_score": 68.8, "f3": 0.7538, "f3_score": 75.4, "tpr": 0.8333, "fpr": 1.0, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 97.7, "cvss_fp_weight": 161.0, "cvss_fn_weight": 20.6, "cvss_precision": 0.3777, "cvss_recall": 0.8259, "cvss_f3": 0.7382, "cvss_f3_score": 73.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": "app/routes/audit-log.tsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": "app/routes/compensation.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": "app/routes/import-export.tsx", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": "app/routes/onboarding.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/onboarding.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": "app/routes/policies.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": "app/routes/profile.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": "app/utils/activity-logger.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/activity-logger.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/activity-logger.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": "app/utils/payroll-provider.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/kiosk-session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": "app/utils/db.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": "app/utils/session.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 8, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 19, "precision": 0.2, "recall": 0.1111, "f1": 0.1429, "f2": 0.122, "f2_score": 12.2, "f3": 0.1163, "f3_score": 11.6, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 12.3, "cvss_fp_weight": 52.4, "cvss_fn_weight": 106.0, "cvss_precision": 0.1902, "cvss_recall": 0.104, "cvss_f3": 0.1089, "cvss_f3_score": 10.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 10, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 15, "recall": 0.1176 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/db/reset.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.documents.$id.download.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/api.notifications.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-027", "file": "app/routes/import-export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-031", "file": "app/routes/requests.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/onboarding-progress.server.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-037", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-legal-case-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 8, "fp": 8, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.3636, "f1": 0.4211, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3738, "f3_score": 37.4, "tpr": 0.3636, "fpr": 1.0, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 50.1, "cvss_fp_weight": 48.5, "cvss_fn_weight": 83.2, "cvss_precision": 0.5083, "cvss_recall": 0.3758, "cvss_f3": 0.3859, "cvss_f3_score": 38.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3846 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": "app/lib/permissions.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 8, "fp": 12, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.3636, "f1": 0.381, "f2": 0.3704, "f2_score": 37.0, "f3": 0.367, "f3_score": 36.7, "tpr": 0.3636, "fpr": 1.0, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 51.7, "cvss_fp_weight": 72.7, "cvss_fn_weight": 81.6, "cvss_precision": 0.4156, "cvss_recall": 0.3878, "cvss_f3": 0.3905, "cvss_f3_score": 39.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.2308 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 13, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.35, "recall": 0.3182, "f1": 0.3333, "f2": 0.3241, "f2_score": 32.4, "f3": 0.3211, "f3_score": 32.1, "tpr": 0.3182, "fpr": 1.0, "youden_j": -0.6818, "cvss_coverage": 1.0, "cvss_tp_weight": 43.6, "cvss_fp_weight": 67.7, "cvss_fn_weight": 89.7, "cvss_precision": 0.3919, "cvss_recall": 0.3271, "cvss_f3": 0.3326, "cvss_f3_score": 33.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.3077 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 14, "recall": 0.3333 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 13, "fp": 15, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4643, "recall": 0.5909, "f1": 0.52, "f2": 0.5603, "f2_score": 56.0, "f3": 0.5752, "f3_score": 57.5, "tpr": 0.5909, "fpr": 1.0, "youden_j": -0.4091, "cvss_coverage": 1.0, "cvss_tp_weight": 78.3, "cvss_fp_weight": 85.3, "cvss_fn_weight": 55.0, "cvss_precision": 0.4785, "cvss_recall": 0.5874, "cvss_f3": 0.5743, "cvss_f3_score": 57.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5385 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 8, "recall": 0.619 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": "app/lib/permissions.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": "app/routes/admin.users.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workspace.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workspace.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 15, "fp": 20, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.6818, "f1": 0.5263, "f2": 0.6098, "f2_score": 61.0, "f3": 0.6438, "f3_score": 64.4, "tpr": 0.6818, "fpr": 1.0, "youden_j": -0.3182, "cvss_coverage": 1.0, "cvss_tp_weight": 98.4, "cvss_fp_weight": 121.2, "cvss_fn_weight": 34.9, "cvss_precision": 0.4481, "cvss_recall": 0.7382, "cvss_f3": 0.6933, "cvss_f3_score": 69.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5385 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 6, "recall": 0.7143 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": "app/lib/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": "app/lib/collab.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": "app/routes/clients.new.tsx", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 14, "fp": 22, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3889, "recall": 0.6364, "f1": 0.4828, "f2": 0.5645, "f2_score": 56.5, "f3": 0.5983, "f3_score": 59.8, "tpr": 0.6364, "fpr": 1.0, "youden_j": -0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 91.8, "cvss_fp_weight": 127.7, "cvss_fn_weight": 41.5, "cvss_precision": 0.4181, "cvss_recall": 0.6887, "cvss_f3": 0.6468, "cvss_f3_score": 64.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6154 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": "app/lib/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": "app/lib/collab.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.new.tsx", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 34, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2917, "recall": 0.6364, "f1": 0.4, "f2": 0.5147, "f2_score": 51.5, "f3": 0.5691, "f3_score": 56.9, "tpr": 0.6364, "fpr": 1.0, "youden_j": -0.3636, "cvss_coverage": 1.0, "cvss_tp_weight": 88.1, "cvss_fp_weight": 194.9, "cvss_fn_weight": 45.2, "cvss_precision": 0.3113, "cvss_recall": 0.6609, "cvss_f3": 0.5942, "cvss_f3_score": 59.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4615 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 7, "recall": 0.6667 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workspace.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.practice-areas.tsx", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": "app/lib/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": "app/lib/collab.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.$id_.edit.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.$id_.edit.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/dashboard.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.new.tsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id_.edit.tsx", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id_.edit.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": "app/routes/clients.new.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": "app/routes/admin.users.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 26, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4348, "recall": 0.9091, "f1": 0.5882, "f2": 0.7463, "f2_score": 74.6, "f3": 0.8197, "f3_score": 82.0, "tpr": 0.9091, "fpr": 1.0, "youden_j": -0.0909, "cvss_coverage": 1.0, "cvss_tp_weight": 124.7, "cvss_fp_weight": 140.9, "cvss_fn_weight": 8.6, "cvss_precision": 0.4696, "cvss_recall": 0.9355, "cvss_f3": 0.851, "cvss_f3_score": 85.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9231 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 2, "recall": 0.9048 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": "app/lib/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": "app/lib/auth.server.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": "app/lib/collab.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directory.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": "app/routes/clients.new.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": "app/lib/permissions.server.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": "app/routes/admin.users.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.users.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": "app/routes/matters.$id.tsx", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.new.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/matters.$id_.edit.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 21, "fp": 15, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.9545, "f1": 0.7241, "f2": 0.8468, "f2_score": 84.7, "f3": 0.8974, "f3_score": 89.7, "tpr": 0.9545, "fpr": 1.0, "youden_j": -0.0455, "cvss_coverage": 1.0, "cvss_tp_weight": 123.5, "cvss_fp_weight": 121.5, "cvss_fn_weight": 9.8, "cvss_precision": 0.5041, "cvss_recall": 0.9265, "cvss_f3": 0.8548, "cvss_f3_score": 85.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 1, "recall": 0.9524 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": "app/lib/auth.server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": "app/lib/directory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": "app/lib/logger.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/permissions.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": "app/lib/practiceAreaBranding.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": "app/routes/admin.retention.tsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.settings.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": "app/routes/admin.users.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/calendar.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients.$id_.edit.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/clients._index.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": "app/routes/clients.new.tsx", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": "app/routes/co-counsel.$matterId.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": "app/routes/documents.$id.download.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": "app/routes/documents.$id.print.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": "app/routes/documents.$id.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": "app/routes/matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": "app/routes/matters.$id.tsx", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": "app/routes/messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": "app/routes/profile.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": "app/lib/permissions.server.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": "app/lib/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": "app/lib/collab.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/dashboard.tsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 16, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1111, "recall": 0.0909, "f1": 0.1, "f2": 0.0943, "f2_score": 9.4, "f3": 0.0926, "f3_score": 9.3, "tpr": 0.0909, "fpr": 1.0, "youden_j": -0.9091, "cvss_coverage": 1.0, "cvss_tp_weight": 16.9, "cvss_fp_weight": 96.9, "cvss_fn_weight": 116.4, "cvss_precision": 0.1484, "cvss_recall": 0.1268, "cvss_f3": 0.1287, "cvss_f3_score": 12.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.0769 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 19, "recall": 0.0952 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/collab.server.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/upload.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-008", "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/workspace.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-009", "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 10, "fp": 8, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.3571, "f1": 0.4348, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3704, "f3_score": 37.0, "tpr": 0.3571, "fpr": 1.0, "youden_j": -0.6429, "cvss_coverage": 1.0, "cvss_tp_weight": 64.1, "cvss_fp_weight": 43.0, "cvss_fn_weight": 105.9, "cvss_precision": 0.5985, "cvss_recall": 0.3771, "cvss_f3": 0.3915, "cvss_f3_score": 39.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-696" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 12, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4783, "recall": 0.3929, "f1": 0.4314, "f2": 0.4074, "f2_score": 40.7, "f3": 0.4, "f3_score": 40.0, "tpr": 0.3929, "fpr": 1.0, "youden_j": -0.6071, "cvss_coverage": 1.0, "cvss_tp_weight": 65.1, "cvss_fp_weight": 67.3, "cvss_fn_weight": 104.9, "cvss_precision": 0.4917, "cvss_recall": 0.3829, "cvss_f3": 0.3916, "cvss_f3_score": 39.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 4, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 11, "fp": 32, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2558, "recall": 0.3929, "f1": 0.3099, "f2": 0.3548, "f2_score": 35.5, "f3": 0.3729, "f3_score": 37.3, "tpr": 0.3929, "fpr": 1.0, "youden_j": -0.6071, "cvss_coverage": 1.0, "cvss_tp_weight": 65.7, "cvss_fp_weight": 172.0, "cvss_fn_weight": 104.3, "cvss_precision": 0.2764, "cvss_recall": 0.3865, "cvss_f3": 0.3717, "cvss_f3_score": 37.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 13, "recall": 0.381 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-799" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 13, "fp": 18, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4194, "recall": 0.4643, "f1": 0.4407, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4594, "f3_score": 45.9, "tpr": 0.4643, "fpr": 1.0, "youden_j": -0.5357, "cvss_coverage": 1.0, "cvss_tp_weight": 74.3, "cvss_fp_weight": 103.7, "cvss_fn_weight": 95.7, "cvss_precision": 0.4174, "cvss_recall": 0.4371, "cvss_f3": 0.435, "cvss_f3_score": 43.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 11, "fp": 19, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3667, "recall": 0.3929, "f1": 0.3793, "f2": 0.3873, "f2_score": 38.7, "f3": 0.3901, "f3_score": 39.0, "tpr": 0.3929, "fpr": 1.0, "youden_j": -0.6071, "cvss_coverage": 1.0, "cvss_tp_weight": 74.8, "cvss_fp_weight": 115.4, "cvss_fn_weight": 95.2, "cvss_precision": 0.3934, "cvss_recall": 0.44, "cvss_f3": 0.4348, "cvss_f3_score": 43.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 12, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 27, "fp": 32, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4576, "recall": 0.9643, "f1": 0.6207, "f2": 0.7895, "f2_score": 78.9, "f3": 0.8682, "f3_score": 86.8, "tpr": 0.9643, "fpr": 1.0, "youden_j": -0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 165.7, "cvss_fp_weight": 194.3, "cvss_fn_weight": 4.3, "cvss_precision": 0.4603, "cvss_recall": 0.9747, "cvss_f3": 0.8767, "cvss_f3_score": 87.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 20, "fp": 0, "fn": 1, "recall": 0.9524 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/app.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/app.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 31, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2955, "recall": 0.4643, "f1": 0.3611, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4392, "f3_score": 43.9, "tpr": 0.4643, "fpr": 1.0, "youden_j": -0.5357, "cvss_coverage": 1.0, "cvss_tp_weight": 81.4, "cvss_fp_weight": 182.6, "cvss_fn_weight": 88.6, "cvss_precision": 0.3083, "cvss_recall": 0.4788, "cvss_f3": 0.4537, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 10, "fp": 0, "fn": 11, "recall": 0.4762 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 3, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/app.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/db/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 25, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5283, "recall": 1.0, "f1": 0.6914, "f2": 0.8485, "f2_score": 84.8, "f3": 0.918, "f3_score": 91.8, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 170.0, "cvss_fp_weight": 146.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.5376, "cvss_recall": 1.0, "cvss_f3": 0.9208, "cvss_f3_score": 92.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 21, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/app.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/app.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/app.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 22, "fp": 29, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4314, "recall": 0.7857, "f1": 0.557, "f2": 0.6748, "f2_score": 67.5, "f3": 0.7261, "f3_score": 72.6, "tpr": 0.7857, "fpr": 1.0, "youden_j": -0.2143, "cvss_coverage": 1.0, "cvss_tp_weight": 130.0, "cvss_fp_weight": 209.5, "cvss_fn_weight": 40.0, "cvss_precision": 0.3829, "cvss_recall": 0.7647, "cvss_f3": 0.6954, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 17, "fp": 0, "fn": 4, "recall": 0.8095 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/app.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/app.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/app.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/app.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/app.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/app.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/app.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/app.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/app.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/app.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/src/app.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/app.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 8, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1111, "recall": 0.0357, "f1": 0.0541, "f2": 0.0413, "f2_score": 4.1, "f3": 0.0383, "f3_score": 3.8, "tpr": 0.0357, "fpr": 1.0, "youden_j": -0.9643, "cvss_coverage": 1.0, "cvss_tp_weight": 7.2, "cvss_fp_weight": 43.0, "cvss_fn_weight": 162.8, "cvss_precision": 0.1434, "cvss_recall": 0.0424, "cvss_f3": 0.0456, "cvss_f3_score": 4.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 20, "recall": 0.0476 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 5, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/app.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/app.ts", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 5, "fp": 13, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2778, "recall": 0.2381, "f1": 0.2564, "f2": 0.2451, "f2_score": 24.5, "f3": 0.2415, "f3_score": 24.2, "tpr": 0.2381, "fpr": 1.0, "youden_j": -0.7619, "cvss_coverage": 1.0, "cvss_tp_weight": 27.1, "cvss_fp_weight": 66.5, "cvss_fn_weight": 109.4, "cvss_precision": 0.2895, "cvss_recall": 0.1985, "cvss_f3": 0.205, "cvss_f3_score": 20.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 9, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.3333, "f1": 0.3784, "f2": 0.35, "f2_score": 35.0, "f3": 0.3415, "f3_score": 34.1, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 51.1, "cvss_fp_weight": 40.5, "cvss_fn_weight": 85.4, "cvss_precision": 0.5579, "cvss_recall": 0.3744, "cvss_f3": 0.3871, "cvss_f3_score": 38.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 5, "fp": 10, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.2381, "f1": 0.2778, "f2": 0.2525, "f2_score": 25.3, "f3": 0.2451, "f3_score": 24.5, "tpr": 0.2381, "fpr": 1.0, "youden_j": -0.7619, "cvss_coverage": 1.0, "cvss_tp_weight": 34.2, "cvss_fp_weight": 35.0, "cvss_fn_weight": 102.3, "cvss_precision": 0.4942, "cvss_recall": 0.2505, "cvss_f3": 0.2635, "cvss_f3_score": 26.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 14, "recall": 0.2632 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 17, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3462, "recall": 0.4286, "f1": 0.383, "f2": 0.4091, "f2_score": 40.9, "f3": 0.4186, "f3_score": 41.9, "tpr": 0.4286, "fpr": 1.0, "youden_j": -0.5714, "cvss_coverage": 1.0, "cvss_tp_weight": 59.1, "cvss_fp_weight": 110.5, "cvss_fn_weight": 77.4, "cvss_precision": 0.3485, "cvss_recall": 0.433, "cvss_f3": 0.4227, "cvss_f3_score": 42.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 10, "recall": 0.4737 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 10, "fp": 30, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.4762, "f1": 0.3279, "f2": 0.4032, "f2_score": 40.3, "f3": 0.4367, "f3_score": 43.7, "tpr": 0.4762, "fpr": 1.0, "youden_j": -0.5238, "cvss_coverage": 1.0, "cvss_tp_weight": 68.9, "cvss_fp_weight": 177.0, "cvss_fn_weight": 67.6, "cvss_precision": 0.2802, "cvss_recall": 0.5048, "cvss_f3": 0.4673, "cvss_f3_score": 46.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 9, "recall": 0.5263 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/seed.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 17, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5278, "recall": 0.9048, "f1": 0.6667, "f2": 0.7917, "f2_score": 79.2, "f3": 0.8444, "f3_score": 84.4, "tpr": 0.9048, "fpr": 1.0, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 120.2, "cvss_fp_weight": 110.5, "cvss_fn_weight": 16.3, "cvss_precision": 0.521, "cvss_recall": 0.8806, "cvss_f3": 0.8237, "cvss_f3_score": 82.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": "backend/src/routes/admin.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": "backend/src/routes/admin.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/admin.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/orders.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 11, "fp": 26, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2973, "recall": 0.5238, "f1": 0.3793, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4867, "f3_score": 48.7, "tpr": 0.5238, "fpr": 1.0, "youden_j": -0.4762, "cvss_coverage": 1.0, "cvss_tp_weight": 73.7, "cvss_fp_weight": 169.0, "cvss_fn_weight": 62.8, "cvss_precision": 0.3037, "cvss_recall": 0.5399, "cvss_f3": 0.501, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 8, "recall": 0.5789 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 11, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.9048, "f1": 0.7451, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8676, "f3_score": 86.8, "tpr": 0.9048, "fpr": 1.0, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 125.1, "cvss_fp_weight": 71.5, "cvss_fn_weight": 11.4, "cvss_precision": 0.6363, "cvss_recall": 0.9165, "cvss_f3": 0.8778, "cvss_f3_score": 87.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": "backend/src/routes/admin.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": "backend/src/routes/admin.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/orders.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 18, "fp": 43, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2951, "recall": 0.8571, "f1": 0.439, "f2": 0.6207, "f2_score": 62.1, "f3": 0.72, "f3_score": 72.0, "tpr": 0.8571, "fpr": 1.0, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 119.7, "cvss_fp_weight": 315.5, "cvss_fn_weight": 16.8, "cvss_precision": 0.275, "cvss_recall": 0.8769, "cvss_f3": 0.7195, "cvss_f3_score": 71.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/admin.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/admin.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/products.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/email.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": "backend/src/routes/admin.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 42, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.087, "recall": 0.1905, "f1": 0.1194, "f2": 0.1538, "f2_score": 15.4, "f3": 0.1702, "f3_score": 17.0, "tpr": 0.1905, "fpr": 1.0, "youden_j": -0.8095, "cvss_coverage": 1.0, "cvss_tp_weight": 29.9, "cvss_fp_weight": 231.0, "cvss_fn_weight": 106.6, "cvss_precision": 0.1146, "cvss_recall": 0.219, "cvss_f3": 0.2008, "cvss_f3_score": 20.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 15, "recall": 0.2105 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/products.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-74" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 3, "fp": 17, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.15, "recall": 0.12, "f1": 0.1333, "f2": 0.125, "f2_score": 12.5, "f3": 0.1224, "f3_score": 12.2, "tpr": 0.12, "fpr": 1.0, "youden_j": -0.88, "cvss_coverage": 1.0, "cvss_tp_weight": 27.0, "cvss_fp_weight": 104.6, "cvss_fn_weight": 135.6, "cvss_precision": 0.2052, "cvss_recall": 0.1661, "cvss_f3": 0.1693, "cvss_f3_score": 16.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.1818 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 20, "recall": 0.1304 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-346" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 9, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.36, "f1": 0.4186, "f2": 0.3814, "f2_score": 38.1, "f3": 0.3704, "f3_score": 37.0, "tpr": 0.36, "fpr": 1.0, "youden_j": -0.64, "cvss_coverage": 1.0, "cvss_tp_weight": 61.4, "cvss_fp_weight": 52.5, "cvss_fn_weight": 101.2, "cvss_precision": 0.5389, "cvss_recall": 0.3776, "cvss_f3": 0.3893, "cvss_f3_score": 38.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/database.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 15, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3182, "recall": 0.28, "f1": 0.2979, "f2": 0.2869, "f2_score": 28.7, "f3": 0.2834, "f3_score": 28.3, "tpr": 0.28, "fpr": 1.0, "youden_j": -0.72, "cvss_coverage": 1.0, "cvss_tp_weight": 45.1, "cvss_fp_weight": 79.5, "cvss_fn_weight": 117.5, "cvss_precision": 0.3618, "cvss_recall": 0.2774, "cvss_f3": 0.284, "cvss_f3_score": 28.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.4545 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 15, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.36, "f1": 0.3673, "f2": 0.3629, "f2_score": 36.3, "f3": 0.3614, "f3_score": 36.1, "tpr": 0.36, "fpr": 1.0, "youden_j": -0.64, "cvss_coverage": 1.0, "cvss_tp_weight": 52.6, "cvss_fp_weight": 97.6, "cvss_fn_weight": 110.0, "cvss_precision": 0.3503, "cvss_recall": 0.3235, "cvss_f3": 0.326, "cvss_f3_score": 32.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 15, "fp": 35, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3, "recall": 0.6, "f1": 0.4, "f2": 0.5, "f2_score": 50.0, "f3": 0.5455, "f3_score": 54.5, "tpr": 0.6, "fpr": 1.0, "youden_j": -0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 105.1, "cvss_fp_weight": 197.6, "cvss_fn_weight": 57.5, "cvss_precision": 0.3472, "cvss_recall": 0.6464, "cvss_f3": 0.5951, "cvss_f3_score": 59.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5455 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 9, "recall": 0.6087 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/database.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-204" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 23, "fp": 38, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.377, "recall": 0.92, "f1": 0.5349, "f2": 0.7143, "f2_score": 71.4, "f3": 0.8042, "f3_score": 80.4, "tpr": 0.92, "fpr": 1.0, "youden_j": -0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 148.0, "cvss_fp_weight": 241.1, "cvss_fn_weight": 14.6, "cvss_precision": 0.3803, "cvss_recall": 0.9102, "cvss_f3": 0.7989, "cvss_f3_score": 79.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 2, "recall": 0.913 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/leases.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 45, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2373, "recall": 0.56, "f1": 0.3333, "f2": 0.4403, "f2_score": 44.0, "f3": 0.493, "f3_score": 49.3, "tpr": 0.56, "fpr": 1.0, "youden_j": -0.44, "cvss_coverage": 1.0, "cvss_tp_weight": 90.0, "cvss_fp_weight": 292.7, "cvss_fn_weight": 72.6, "cvss_precision": 0.2352, "cvss_recall": 0.5535, "cvss_f3": 0.4875, "cvss_f3_score": 48.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8182 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 10, "recall": 0.5652 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/payments.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 23, "fp": 52, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3067, "recall": 0.92, "f1": 0.46, "f2": 0.6571, "f2_score": 65.7, "f3": 0.7667, "f3_score": 76.7, "tpr": 0.92, "fpr": 1.0, "youden_j": -0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 148.0, "cvss_fp_weight": 332.2, "cvss_fn_weight": 14.6, "cvss_precision": 0.3082, "cvss_recall": 0.9102, "cvss_f3": 0.7615, "cvss_f3_score": 76.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9091 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 2, "recall": 0.913 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/entities/ApiKey.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/entities/User.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/leases.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 23, "fp": 58, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.284, "recall": 0.92, "f1": 0.434, "f2": 0.6354, "f2_score": 63.5, "f3": 0.7516, "f3_score": 75.2, "tpr": 0.92, "fpr": 1.0, "youden_j": -0.08, "cvss_coverage": 1.0, "cvss_tp_weight": 146.3, "cvss_fp_weight": 403.0, "cvss_fn_weight": 16.3, "cvss_precision": 0.2663, "cvss_recall": 0.8998, "cvss_f3": 0.7269, "cvss_f3_score": 72.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 6, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 2, "recall": 0.913 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/payments.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/deviceSessions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/database.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/maintenance.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 11, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 71.5, "cvss_fn_weight": 162.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 11, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/database.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/corporateDirectory.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 5, "fp": 15, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.25, "recall": 0.2083, "f1": 0.2273, "f2": 0.2155, "f2_score": 21.6, "f3": 0.2119, "f3_score": 21.2, "tpr": 0.2083, "fpr": 1.0, "youden_j": -0.7917, "cvss_coverage": 1.0, "cvss_tp_weight": 36.7, "cvss_fp_weight": 95.9, "cvss_fn_weight": 116.8, "cvss_precision": 0.2767, "cvss_recall": 0.2391, "cvss_f3": 0.2424, "cvss_f3_score": 24.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 18, "recall": 0.2174 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.module.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.module.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/ticket/ticket-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/knowledge-base/kb-detail/kb-detail.component.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 4, "fp": 17, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.1905, "recall": 0.1667, "f1": 0.1778, "f2": 0.1709, "f2_score": 17.1, "f3": 0.1688, "f3_score": 16.9, "tpr": 0.1667, "fpr": 1.0, "youden_j": -0.8333, "cvss_coverage": 1.0, "cvss_tp_weight": 30.4, "cvss_fp_weight": 96.9, "cvss_fn_weight": 123.1, "cvss_precision": 0.2387, "cvss_recall": 0.198, "cvss_f3": 0.2015, "cvss_f3_score": 20.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 19, "recall": 0.1739 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/ticket/ticket-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/knowledge-base/kb-detail/kb-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 7, "fp": 6, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.5385, "recall": 0.2917, "f1": 0.3784, "f2": 0.3211, "f2_score": 32.1, "f3": 0.3057, "f3_score": 30.6, "tpr": 0.2917, "fpr": 1.0, "youden_j": -0.7083, "cvss_coverage": 1.0, "cvss_tp_weight": 50.2, "cvss_fp_weight": 38.4, "cvss_fn_weight": 103.3, "cvss_precision": 0.5668, "cvss_recall": 0.327, "cvss_f3": 0.3415, "cvss_f3_score": 34.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 10, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.4444, "recall": 0.3333, "f1": 0.381, "f2": 0.3509, "f2_score": 35.1, "f3": 0.3419, "f3_score": 34.2, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 55.1, "cvss_fp_weight": 64.0, "cvss_fn_weight": 98.4, "cvss_precision": 0.4628, "cvss_recall": 0.359, "cvss_f3": 0.3672, "cvss_f3_score": 36.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-353" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 27, "fn": 11, "tn": 0, "ns": 1, "ns_gt": 4, "precision": 0.325, "recall": 0.5417, "f1": 0.4062, "f2": 0.4779, "f2_score": 47.8, "f3": 0.5078, "f3_score": 50.8, "tpr": 0.5417, "fpr": 1.0, "youden_j": -0.4583, "cvss_coverage": 1.0, "cvss_tp_weight": 87.5, "cvss_fp_weight": 137.3, "cvss_fn_weight": 66.0, "cvss_precision": 0.3892, "cvss_recall": 0.57, "cvss_f3": 0.5447, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 11, "recall": 0.5217 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/ticket/ticket-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/knowledge-base/kb-detail/kb-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/shared/auth.service.ts", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 9, "fp": 20, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3103, "recall": 0.375, "f1": 0.3396, "f2": 0.36, "f2_score": 36.0, "f3": 0.3673, "f3_score": 36.7, "tpr": 0.375, "fpr": 1.0, "youden_j": -0.625, "cvss_coverage": 1.0, "cvss_tp_weight": 53.8, "cvss_fp_weight": 127.9, "cvss_fn_weight": 99.7, "cvss_precision": 0.2961, "cvss_recall": 0.3505, "cvss_f3": 0.3442, "cvss_f3_score": 34.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 10, "fp": 16, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3846, "recall": 0.4167, "f1": 0.4, "f2": 0.4098, "f2_score": 41.0, "f3": 0.4132, "f3_score": 41.3, "tpr": 0.4167, "fpr": 1.0, "youden_j": -0.5833, "cvss_coverage": 1.0, "cvss_tp_weight": 68.6, "cvss_fp_weight": 102.3, "cvss_fn_weight": 84.9, "cvss_precision": 0.4013, "cvss_recall": 0.4469, "cvss_f3": 0.4419, "cvss_f3_score": 44.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 14, "recall": 0.3913 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 21, "fp": 18, "fn": 3, "tn": 0, "ns": 1, "ns_gt": 4, "precision": 0.5385, "recall": 0.875, "f1": 0.6667, "f2": 0.7778, "f2_score": 77.8, "f3": 0.8235, "f3_score": 82.4, "tpr": 0.875, "fpr": 1.0, "youden_j": -0.125, "cvss_coverage": 1.0, "cvss_tp_weight": 131.3, "cvss_fp_weight": 115.1, "cvss_fn_weight": 22.2, "cvss_precision": 0.5328, "cvss_recall": 0.8554, "cvss_f3": 0.8065, "cvss_f3_score": 80.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 3, "recall": 0.8696 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 31, "fn": 0, "tn": 0, "ns": 11, "ns_gt": 4, "precision": 0.4364, "recall": 1.0, "f1": 0.6076, "f2": 0.7947, "f2_score": 79.5, "f3": 0.8856, "f3_score": 88.6, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 153.5, "cvss_fp_weight": 229.5, "cvss_fn_weight": 0.0, "cvss_precision": 0.4008, "cvss_recall": 1.0, "cvss_f3": 0.8699, "cvss_f3_score": 87.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/sla/sla.service.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/knowledge-base/kb-detail/kb-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/ticket/ticket-detail.component.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/portal/portal.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-306" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 13, "fn": 23, "tn": 0, "ns": 1, "ns_gt": 4, "precision": 0.0714, "recall": 0.0417, "f1": 0.0526, "f2": 0.0455, "f2_score": 4.5, "f3": 0.0435, "f3_score": 4.3, "tpr": 0.0417, "fpr": 1.0, "youden_j": -0.9583, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 77.2, "cvss_fn_weight": 144.7, "cvss_precision": 0.1023, "cvss_recall": 0.0573, "cvss_f3": 0.06, "cvss_f3_score": 6.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 22, "recall": 0.0435 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/portal/portal.controller.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/reports/reports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/shared/api.service.ts", "cwe": "CWE-134" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-203" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 3, "fp": 15, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1667, "recall": 0.1, "f1": 0.125, "f2": 0.1087, "f2_score": 10.9, "f3": 0.1042, "f3_score": 10.4, "tpr": 0.1, "fpr": 1.0, "youden_j": -0.9, "cvss_coverage": 1.0, "cvss_tp_weight": 25.1, "cvss_fp_weight": 86.1, "cvss_fn_weight": 171.3, "cvss_precision": 0.2257, "cvss_recall": 0.1278, "cvss_f3": 0.1336, "cvss_f3_score": 13.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 24, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.controller.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 17, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2609, "recall": 0.2, "f1": 0.2264, "f2": 0.2098, "f2_score": 21.0, "f3": 0.2048, "f3_score": 20.5, "tpr": 0.2, "fpr": 1.0, "youden_j": -0.8, "cvss_coverage": 1.0, "cvss_tp_weight": 46.2, "cvss_fp_weight": 93.2, "cvss_fn_weight": 150.2, "cvss_precision": 0.3315, "cvss_recall": 0.2352, "cvss_f3": 0.2423, "cvss_f3_score": 24.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 21, "recall": 0.2222 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/comments/comments.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 8, "fp": 12, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.2667, "f1": 0.32, "f2": 0.2857, "f2_score": 28.6, "f3": 0.2759, "f3_score": 27.6, "tpr": 0.2667, "fpr": 1.0, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 57.0, "cvss_fp_weight": 72.5, "cvss_fn_weight": 139.4, "cvss_precision": 0.4401, "cvss_recall": 0.2902, "cvss_f3": 0.3005, "cvss_f3_score": 30.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 19, "recall": 0.2963 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 18, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3077, "recall": 0.2667, "f1": 0.2857, "f2": 0.274, "f2_score": 27.4, "f3": 0.2703, "f3_score": 27.0, "tpr": 0.2667, "fpr": 1.0, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 57.4, "cvss_fp_weight": 117.8, "cvss_fn_weight": 139.0, "cvss_precision": 0.3276, "cvss_recall": 0.2923, "cvss_f3": 0.2954, "cvss_f3_score": 29.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 19, "recall": 0.2963 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/comments/comments.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/features/auth/login.component.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/environments/environment.prod.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 10, "fp": 41, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1961, "recall": 0.3333, "f1": 0.2469, "f2": 0.2924, "f2_score": 29.2, "f3": 0.3115, "f3_score": 31.2, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 69.2, "cvss_fp_weight": 201.9, "cvss_fn_weight": 127.2, "cvss_precision": 0.2553, "cvss_recall": 0.3523, "cvss_f3": 0.3394, "cvss_f3_score": 33.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 18, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.controller.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 30, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 196.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 31, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2791, "recall": 0.4, "f1": 0.3288, "f2": 0.3681, "f2_score": 36.8, "f3": 0.3834, "f3_score": 38.3, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 86.5, "cvss_fp_weight": 196.9, "cvss_fn_weight": 109.9, "cvss_precision": 0.3052, "cvss_recall": 0.4404, "cvss_f3": 0.4217, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 15, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/comments/comments.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 11, "fp": 22, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.3667, "f1": 0.3492, "f2": 0.3595, "f2_score": 35.9, "f3": 0.363, "f3_score": 36.3, "tpr": 0.3667, "fpr": 1.0, "youden_j": -0.6333, "cvss_coverage": 1.0, "cvss_tp_weight": 68.6, "cvss_fp_weight": 138.0, "cvss_fn_weight": 127.8, "cvss_precision": 0.3321, "cvss_recall": 0.3493, "cvss_f3": 0.3475, "cvss_f3_score": 34.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 17, "recall": 0.3704 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/comments/comments.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.module.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/environments/environment.prod.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 49, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3378, "recall": 0.8333, "f1": 0.4808, "f2": 0.6443, "f2_score": 64.4, "f3": 0.7267, "f3_score": 72.7, "tpr": 0.8333, "fpr": 1.0, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 164.0, "cvss_fp_weight": 371.5, "cvss_fn_weight": 32.4, "cvss_precision": 0.3063, "cvss_recall": 0.835, "cvss_f3": 0.7121, "cvss_f3_score": 71.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 3, "recall": 0.8889 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": "backend/src/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit-logs/audit-logs.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/common/session/desk-session.store.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": "backend/src/health/dashboard.service.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": "backend/src/contacts/contacts.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/test/auth.e2e-spec.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 19, "fn": 28, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0952, "recall": 0.0667, "f1": 0.0784, "f2": 0.0709, "f2_score": 7.1, "f3": 0.0687, "f3_score": 6.9, "tpr": 0.0667, "fpr": 1.0, "youden_j": -0.9333, "cvss_coverage": 1.0, "cvss_tp_weight": 16.9, "cvss_fp_weight": 106.2, "cvss_fn_weight": 179.5, "cvss_precision": 0.1372, "cvss_recall": 0.086, "cvss_f3": 0.0894, "cvss_f3_score": 8.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 25, "recall": 0.0741 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/api-keys/api-keys.controller.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/deals/deals.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-017", "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/documents/documents.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-018", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/health/dashboard.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/organizations/organizations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.controller.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 5, "fp": 13, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2778, "recall": 0.1852, "f1": 0.2222, "f2": 0.1984, "f2_score": 19.8, "f3": 0.1916, "f3_score": 19.2, "tpr": 0.1852, "fpr": 1.0, "youden_j": -0.8148, "cvss_coverage": 1.0, "cvss_tp_weight": 35.2, "cvss_fp_weight": 85.3, "cvss_fn_weight": 142.0, "cvss_precision": 0.2921, "cvss_recall": 0.1986, "cvss_f3": 0.2052, "cvss_f3_score": 20.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 19, "recall": 0.2083 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/download-naming.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/announcement-render.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 18, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.28, "recall": 0.2593, "f1": 0.2692, "f2": 0.2632, "f2_score": 26.3, "f3": 0.2612, "f3_score": 26.1, "tpr": 0.2593, "fpr": 1.0, "youden_j": -0.7407, "cvss_coverage": 1.0, "cvss_tp_weight": 50.3, "cvss_fp_weight": 106.0, "cvss_fn_weight": 126.9, "cvss_precision": 0.3218, "cvss_recall": 0.2839, "cvss_f3": 0.2872, "cvss_f3_score": 28.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 18, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/files.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-integration.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": "src/lib/course-branding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-search.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 6, "fp": 8, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.2222, "f1": 0.2927, "f2": 0.2459, "f2_score": 24.6, "f3": 0.2335, "f3_score": 23.3, "tpr": 0.2222, "fpr": 1.0, "youden_j": -0.7778, "cvss_coverage": 1.0, "cvss_tp_weight": 49.3, "cvss_fp_weight": 34.3, "cvss_fn_weight": 127.9, "cvss_precision": 0.5896, "cvss_recall": 0.2782, "cvss_f3": 0.2937, "cvss_f3_score": 29.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 18, "recall": 0.25 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 18, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.3333, "f1": 0.3333, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 63.8, "cvss_fp_weight": 118.1, "cvss_fn_weight": 113.4, "cvss_precision": 0.3507, "cvss_recall": 0.36, "cvss_f3": 0.3591, "cvss_f3_score": 35.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 15, "recall": 0.375 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/announcement-render.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/frame-policy.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/feedback-assistant.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": "src/lib/livestream-session.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/download-naming.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/continuity.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": "src/lib/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 27, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.325, "recall": 0.4815, "f1": 0.3881, "f2": 0.4392, "f2_score": 43.9, "f3": 0.4594, "f3_score": 45.9, "tpr": 0.4815, "fpr": 1.0, "youden_j": -0.5185, "cvss_coverage": 1.0, "cvss_tp_weight": 89.1, "cvss_fp_weight": 152.9, "cvss_fn_weight": 88.1, "cvss_precision": 0.3681, "cvss_recall": 0.5028, "cvss_f3": 0.4851, "cvss_f3_score": 48.5, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 13, "recall": 0.4583 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-integration.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/admin/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/admin/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/uploads/[...path]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/download-naming.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": "src/actions/admin.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/frame-policy.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": "src/lib/livestream-session.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": "src/lib/livestream-session.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/feedback-assistant.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": "src/lib/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 13, "fp": 34, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2766, "recall": 0.4815, "f1": 0.3514, "f2": 0.4194, "f2_score": 41.9, "f3": 0.4483, "f3_score": 44.8, "tpr": 0.4815, "fpr": 1.0, "youden_j": -0.5185, "cvss_coverage": 1.0, "cvss_tp_weight": 79.7, "cvss_fp_weight": 223.1, "cvss_fn_weight": 97.5, "cvss_precision": 0.2632, "cvss_recall": 0.4498, "cvss_f3": 0.42, "cvss_f3_score": 42.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 13, "recall": 0.4583 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": "src/lib/course-branding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/admin/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/discussions/page.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/content-import.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/files.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/student/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": "src/actions/admin.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": "src/lib/livestream-session.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": "src/lib/livestream-session.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-search.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/catalog/directory/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/grades/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/submissions/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-integration.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": "src/actions/grading.ts", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 24, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.5185, "f1": 0.4308, "f2": 0.4795, "f2_score": 47.9, "f3": 0.4982, "f3_score": 49.8, "tpr": 0.5185, "fpr": 1.0, "youden_j": -0.4815, "cvss_coverage": 1.0, "cvss_tp_weight": 100.4, "cvss_fp_weight": 157.5, "cvss_fn_weight": 76.8, "cvss_precision": 0.3893, "cvss_recall": 0.5666, "cvss_f3": 0.5419, "cvss_f3_score": 54.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 13, "recall": 0.4583 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": "src/lib/course-branding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/files.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/admin/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/discussions/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/submissions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": "src/actions/admin.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/catalog-search.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": "src/lib/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": "src/lib/transcript-link.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 11, "fp": 31, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2619, "recall": 0.4074, "f1": 0.3188, "f2": 0.3667, "f2_score": 36.7, "f3": 0.386, "f3_score": 38.6, "tpr": 0.4074, "fpr": 1.0, "youden_j": -0.5926, "cvss_coverage": 1.0, "cvss_tp_weight": 72.3, "cvss_fp_weight": 197.4, "cvss_fn_weight": 104.9, "cvss_precision": 0.2681, "cvss_recall": 0.408, "cvss_f3": 0.3878, "cvss_f3_score": 38.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 15, "recall": 0.375 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": "src/lib/course-branding.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/partner-sync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": "src/actions/admin.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/admin/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/discussions/page.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/dashboard/student/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/support-log.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/classroom/live-broadcast/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/classroom/live-broadcast-primary/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/classroom/live-broadcast/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": "src/lib/livestream-session.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embed-cors.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/frame-policy.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/grades/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 26, "fp": 41, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3881, "recall": 0.963, "f1": 0.5532, "f2": 0.7429, "f2_score": 74.3, "f3": 0.8387, "f3_score": 83.9, "tpr": 0.963, "fpr": 1.0, "youden_j": -0.037, "cvss_coverage": 1.0, "cvss_tp_weight": 173.5, "cvss_fp_weight": 317.0, "cvss_fn_weight": 3.7, "cvss_precision": 0.3537, "cvss_recall": 0.9791, "cvss_f3": 0.832, "cvss_f3_score": 83.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 1, "recall": 0.9583 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": "src/actions/admin.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/files.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": "src/actions/grading.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/insights.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/partner-allocation.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": "src/app/api/grading/answer-key-package/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/partner/cost-allocation/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/assignments/[assignmentId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/discussions/[threadId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/discussions/[threadId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/modules/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/courses/[courseId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/submissions/[submissionId]/page.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/announcement-render.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": "src/lib/catalog-search.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": "src/lib/course-branding.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/enrollment-claim.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/livestream-session.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/livestream-session.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": "src/lib/logger.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": "src/lib/partner-integration.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": "src/lib/partner-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/transcript-link.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": "src/actions/content-import.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": "src/lib/livestream-session.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": "src/lib/livestream-session.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/mobile-bridge.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/classroom/display-handoff/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": "src/actions/insights.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/grading.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/grading.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/grading.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": "src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": "src/lib/reset.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": "src/lib/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": "src/lib/transcript-link.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": "src/middleware.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": "src/actions/admin.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 2, "fp": 21, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.087, "recall": 0.0741, "f1": 0.08, "f2": 0.0763, "f2_score": 7.6, "f3": 0.0752, "f3_score": 7.5, "tpr": 0.0741, "fpr": 1.0, "youden_j": -0.9259, "cvss_coverage": 1.0, "cvss_tp_weight": 16.9, "cvss_fp_weight": 137.8, "cvss_fn_weight": 160.3, "cvss_precision": 0.1092, "cvss_recall": 0.0954, "cvss_f3": 0.0966, "cvss_f3_score": 9.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 2, "fp": 0, "fn": 22, "recall": 0.0833 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/admin.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/course-branding.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/document-library.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exam-package.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/frame-policy.ts", "cwe": "CWE-451" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/frame-policy.ts", "cwe": "CWE-451" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-020", "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/module-publishing.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-023", "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/report-conversion.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/upload.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 3, "fp": 18, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 0.1111, "f1": 0.125, "f2": 0.1163, "f2_score": 11.6, "f3": 0.1136, "f3_score": 11.4, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 16.2, "cvss_fp_weight": 125.9, "cvss_fn_weight": 172.7, "cvss_precision": 0.114, "cvss_recall": 0.0858, "cvss_f3": 0.0879, "cvss_f3_score": 8.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 19, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 21, "recall": 0.125 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-696" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": "src/routes/applications.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": "src/routes/applications.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 5, "fp": 13, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2778, "recall": 0.1852, "f1": 0.2222, "f2": 0.1984, "f2_score": 19.8, "f3": 0.1916, "f3_score": 19.2, "tpr": 0.1852, "fpr": 1.0, "youden_j": -0.8148, "cvss_coverage": 1.0, "cvss_tp_weight": 42.0, "cvss_fp_weight": 84.5, "cvss_fn_weight": 146.9, "cvss_precision": 0.3321, "cvss_recall": 0.2223, "cvss_f3": 0.2299, "cvss_f3_score": 23.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1579 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 20, "recall": 0.1667 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 5, "fp": 16, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.1852, "f1": 0.2083, "f2": 0.1938, "f2_score": 19.4, "f3": 0.1894, "f3_score": 18.9, "tpr": 0.1852, "fpr": 1.0, "youden_j": -0.8148, "cvss_coverage": 1.0, "cvss_tp_weight": 39.2, "cvss_fp_weight": 92.5, "cvss_fn_weight": 149.7, "cvss_precision": 0.2978, "cvss_recall": 0.2075, "cvss_f3": 0.214, "cvss_f3_score": 21.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1579 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 20, "recall": 0.1667 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": "src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": "src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 5, "fp": 16, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2381, "recall": 0.1852, "f1": 0.2083, "f2": 0.1938, "f2_score": 19.4, "f3": 0.1894, "f3_score": 18.9, "tpr": 0.1852, "fpr": 1.0, "youden_j": -0.8148, "cvss_coverage": 1.0, "cvss_tp_weight": 37.5, "cvss_fp_weight": 105.4, "cvss_fn_weight": 151.4, "cvss_precision": 0.2623, "cvss_recall": 0.1985, "cvss_f3": 0.2035, "cvss_f3_score": 20.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1579 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 19, "recall": 0.2083 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-1426" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": "src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": null, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 8, "fp": 27, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2286, "recall": 0.2963, "f1": 0.2581, "f2": 0.2797, "f2_score": 28.0, "f3": 0.2878, "f3_score": 28.8, "tpr": 0.2963, "fpr": 1.0, "youden_j": -0.7037, "cvss_coverage": 1.0, "cvss_tp_weight": 54.2, "cvss_fp_weight": 182.4, "cvss_fn_weight": 134.7, "cvss_precision": 0.2291, "cvss_recall": 0.2869, "cvss_f3": 0.2799, "cvss_f3_score": 28.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.3158 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 18, "recall": 0.25 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": "src/routes/products.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": "src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": "src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": "src/routes/documents.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 32, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3043, "recall": 0.5185, "f1": 0.3836, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4844, "f3_score": 48.4, "tpr": 0.5185, "fpr": 1.0, "youden_j": -0.4815, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 223.9, "cvss_fn_weight": 93.7, "cvss_precision": 0.2984, "cvss_recall": 0.504, "cvss_f3": 0.4715, "cvss_f3_score": 47.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4737 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 12, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": "src/server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": "src/routes/products.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": "src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": "src/routes/documents.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": "src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": "src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": "src/routes/decisions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": "src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 20, "fp": 27, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4255, "recall": 0.7407, "f1": 0.5405, "f2": 0.6452, "f2_score": 64.5, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.7407, "fpr": 1.0, "youden_j": -0.2593, "cvss_coverage": 1.0, "cvss_tp_weight": 135.7, "cvss_fp_weight": 182.4, "cvss_fn_weight": 53.2, "cvss_precision": 0.4266, "cvss_recall": 0.7184, "cvss_f3": 0.6724, "cvss_f3_score": 67.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7895 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 17, "fp": 0, "fn": 7, "recall": 0.7083 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/config/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/audit.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": "src/routes/products.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": "src/routes/applications.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": "src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": "src/routes/documents.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": "src/routes/applications.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": "src/routes/applications.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": "src/routes/applications.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": "src/routes/audit.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": "src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": "src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": "src/routes/dashboard.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": "src/routes/decisions.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": "src/routes/import-export.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": "src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 72, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2577, "recall": 0.9259, "f1": 0.4032, "f2": 0.6098, "f2_score": 61.0, "f3": 0.7353, "f3_score": 73.5, "tpr": 0.9259, "fpr": 1.0, "youden_j": -0.0741, "cvss_coverage": 1.0, "cvss_tp_weight": 174.8, "cvss_fp_weight": 541.5, "cvss_fn_weight": 14.1, "cvss_precision": 0.244, "cvss_recall": 0.9254, "cvss_f3": 0.7234, "cvss_f3_score": 72.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9474 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 22, "fp": 0, "fn": 2, "recall": 0.9167 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": "src/routes/applications.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": "src/routes/borrowers.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/borrowers.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/dashboard.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": "src/routes/decisions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": "src/routes/documents.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/notes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": "src/routes/products.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": "src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": "src/services/logger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": "src/routes/import-export.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/api-keys.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": "src/routes/applications.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": "src/routes/applications.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": "src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": "src/routes/import-export.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": "src/routes/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": "src/routes/auth.ts", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": "src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": "src/routes/applications.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": "src/routes/audit.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": "src/routes/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": "src/routes/dashboard.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/decisions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": "src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": "src/server.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 29, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0938, "recall": 0.1111, "f1": 0.1017, "f2": 0.1071, "f2_score": 10.7, "f3": 0.1091, "f3_score": 10.9, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 25.7, "cvss_fp_weight": 202.9, "cvss_fn_weight": 163.2, "cvss_precision": 0.1124, "cvss_recall": 0.1361, "cvss_f3": 0.1333, "cvss_f3_score": 13.3, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.0526 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 21, "recall": 0.125 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "client/src/pages/AdminDashboard.tsx", "cwe": "CWE-116" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/applications.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-016", "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/documents.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-020", "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/import-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/products.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-023", "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/templates.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/routes/webhooks.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/services/caseFileSeal.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-117" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 11, "fp": 7, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6111, "recall": 0.4231, "f1": 0.5, "f2": 0.4508, "f2_score": 45.1, "f3": 0.4365, "f3_score": 43.7, "tpr": 0.4231, "fpr": 1.0, "youden_j": -0.5769, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 33.2, "cvss_fn_weight": 87.9, "cvss_precision": 0.7056, "cvss_recall": 0.4752, "cvss_f3": 0.4913, "cvss_f3_score": 49.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 13, "recall": 0.4583 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/intake/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverageEligibility.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 9, "fp": 11, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.45, "recall": 0.3462, "f1": 0.3913, "f2": 0.3629, "f2_score": 36.3, "f3": 0.3543, "f3_score": 35.4, "tpr": 0.3462, "fpr": 1.0, "youden_j": -0.6538, "cvss_coverage": 1.0, "cvss_tp_weight": 67.8, "cvss_fp_weight": 53.0, "cvss_fn_weight": 99.7, "cvss_precision": 0.5611, "cvss_recall": 0.4048, "cvss_f3": 0.4164, "cvss_f3_score": 41.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 15, "recall": 0.375 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/preferences.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referralLink.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/series/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/series/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-400" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 167.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 24, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 12, "fp": 17, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4138, "recall": 0.4615, "f1": 0.4364, "f2": 0.4511, "f2_score": 45.1, "f3": 0.4563, "f3_score": 45.6, "tpr": 0.4615, "fpr": 1.0, "youden_j": -0.5385, "cvss_coverage": 1.0, "cvss_tp_weight": 83.9, "cvss_fp_weight": 97.6, "cvss_fn_weight": 83.6, "cvss_precision": 0.4622, "cvss_recall": 0.5009, "cvss_f3": 0.4967, "cvss_f3_score": 49.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 12, "recall": 0.5 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/preferences.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageTemplates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageTemplates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverageEligibility.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverageEligibility.ts", "cwe": "CWE-697" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/intake/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/embedPolicy.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/session.ts", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 40, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2453, "recall": 0.5, "f1": 0.3291, "f2": 0.414, "f2_score": 41.4, "f3": 0.453, "f3_score": 45.3, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 90.4, "cvss_fp_weight": 239.9, "cvss_fn_weight": 77.1, "cvss_precision": 0.2737, "cvss_recall": 0.5397, "cvss_f3": 0.4919, "cvss_f3_score": 49.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 12, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/convert/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/[id]/label/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageTemplates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/reminder-preview/route.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/dashboard/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/intake/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/intake/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/forms/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/appointments/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/coverage-directory/route.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverageEligibility.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/coverageEligibility.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/coverage-directory/grant/route.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/coverage-directory/grant/route.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/series/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/series/route.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/appointments/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/actions/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/login/page.tsx", "cwe": "CWE-260" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 21, "fp": 28, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.8077, "f1": 0.56, "f2": 0.6863, "f2_score": 68.6, "f3": 0.742, "f3_score": 74.2, "tpr": 0.8077, "fpr": 1.0, "youden_j": -0.1923, "cvss_coverage": 1.0, "cvss_tp_weight": 129.0, "cvss_fp_weight": 162.6, "cvss_fn_weight": 38.5, "cvss_precision": 0.4425, "cvss_recall": 0.7701, "cvss_f3": 0.717, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 5, "recall": 0.7917 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/actions/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": "src/app/actions/actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": "src/app/actions/actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/actions/actions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/api-keys/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/visits/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/dashboard/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/dashboard/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/prescriptions/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/search/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/schedule/handoff-link/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/patients/[id]/kiosk-session/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/clearinghouse.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/careAssistant.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referralLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 18, "fp": 28, "fn": 8, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3913, "recall": 0.6923, "f1": 0.5, "f2": 0.6, "f2_score": 60.0, "f3": 0.6429, "f3_score": 64.3, "tpr": 0.6923, "fpr": 1.0, "youden_j": -0.3077, "cvss_coverage": 1.0, "cvss_tp_weight": 118.4, "cvss_fp_weight": 162.6, "cvss_fn_weight": 49.1, "cvss_precision": 0.4214, "cvss_recall": 0.7069, "cvss_f3": 0.662, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 8, "recall": 0.6667 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referralLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/route.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/prescriptions/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/dashboard/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/search/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/audit/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/careAssistant.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/actions/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/prisma.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/actions/actions.ts", "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 13, "fp": 28, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3171, "recall": 0.5, "f1": 0.3881, "f2": 0.4483, "f2_score": 44.8, "f3": 0.4727, "f3_score": 47.3, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 87.6, "cvss_fp_weight": 180.4, "cvss_fn_weight": 79.9, "cvss_precision": 0.3269, "cvss_recall": 0.523, "cvss_f3": 0.4934, "cvss_f3_score": 49.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 12, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/referralLink.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/clearinghouse.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/careAssistant.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/series/route.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/visits/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/dashboard/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/dashboard/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/search/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(app)/prescriptions/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/audit/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/[id]/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-362" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-400" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 22, "fp": 28, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.8462, "f1": 0.5789, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7746, "f3_score": 77.5, "tpr": 0.8462, "fpr": 1.0, "youden_j": -0.1538, "cvss_coverage": 1.0, "cvss_tp_weight": 138.2, "cvss_fp_weight": 190.5, "cvss_fn_weight": 29.3, "cvss_precision": 0.4204, "cvss_recall": 0.8251, "cvss_f3": 0.7526, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 4, "recall": 0.8333 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": "src/app/actions/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/app/actions/actions.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/visits/convert/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/patients/route.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/import/patients/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/[id]/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/users/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/convert/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/external-release/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/app/api/documents/external-release/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/chart-label/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/[id]/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/coverage-directory/grant-verified/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/schedule/expand/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/schedule/handoff-link/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/resolve/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/search/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/careAssistant.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/lib/clearinghouse.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/lib/directoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/lib/exportDiagnostics.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/messageTemplates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/lib/referralLink.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/lib/searchActivityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/lib/preferences.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/lib/companionAccess.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/app/api/patients/[id]/kiosk-session/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/lib/seriesScheduling.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": "src/app/actions/actions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/lib/session.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/referrals/resolve/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 12, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.1538, "f1": 0.1905, "f2": 0.1667, "f2_score": 16.7, "f3": 0.16, "f3_score": 16.0, "tpr": 0.1538, "fpr": 1.0, "youden_j": -0.8462, "cvss_coverage": 1.0, "cvss_tp_weight": 32.2, "cvss_fp_weight": 71.4, "cvss_fn_weight": 135.3, "cvss_precision": 0.3109, "cvss_recall": 0.1922, "cvss_f3": 0.1999, "cvss_f3_score": 20.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 20, "recall": 0.1667 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/actions/actions.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/export/visits/convert/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/admin/settings/letterhead/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/[id]/companion-link/route.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/providers/[id]/photo/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/documentConvert.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/formLibrary.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/labelPrinting.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/recordRelease.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/reportCache.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 6, "fp": 15, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2857, "recall": 0.2308, "f1": 0.2553, "f2": 0.24, "f2_score": 24.0, "f3": 0.2353, "f3_score": 23.5, "tpr": 0.2308, "fpr": 1.0, "youden_j": -0.7692, "cvss_coverage": 1.0, "cvss_tp_weight": 42.3, "cvss_fp_weight": 93.9, "cvss_fn_weight": 120.4, "cvss_precision": 0.3107, "cvss_recall": 0.26, "cvss_f3": 0.2643, "cvss_f3_score": 26.4, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 19, "recall": 0.24 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-835" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.server.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyNotice.server.ts", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 3, "fp": 9, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.1154, "f1": 0.1579, "f2": 0.1293, "f2_score": 12.9, "f3": 0.122, "f3_score": 12.2, "tpr": 0.1154, "fpr": 1.0, "youden_j": -0.8846, "cvss_coverage": 1.0, "cvss_tp_weight": 23.1, "cvss_fp_weight": 56.3, "cvss_fn_weight": 139.6, "cvss_precision": 0.2909, "cvss_recall": 0.142, "cvss_f3": 0.1496, "cvss_f3_score": 15.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 22, "recall": 0.12 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.documents.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.policies.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 162.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 25, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 8, "fp": 23, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2581, "recall": 0.3077, "f1": 0.2807, "f2": 0.2963, "f2_score": 29.6, "f3": 0.3019, "f3_score": 30.2, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 57.9, "cvss_fp_weight": 132.4, "cvss_fn_weight": 104.8, "cvss_precision": 0.3042, "cvss_recall": 0.3559, "cvss_f3": 0.3499, "cvss_f3_score": 35.0, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 17, "recall": 0.32 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyNotice.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": "app/utils/orgChart.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/db/seed.ts", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 10, "fp": 35, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.3846, "f1": 0.2817, "f2": 0.3356, "f2_score": 33.6, "f3": 0.3584, "f3_score": 35.8, "tpr": 0.3846, "fpr": 1.0, "youden_j": -0.6154, "cvss_coverage": 1.0, "cvss_tp_weight": 72.9, "cvss_fp_weight": 190.2, "cvss_fn_weight": 89.8, "cvss_precision": 0.277, "cvss_recall": 0.4481, "cvss_f3": 0.422, "cvss_f3_score": 42.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 15, "recall": 0.4 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/attachments.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/workflowConnector.server.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": "app/routes/partner.benefits-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyNotice.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyNotice.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.server.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-835" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": "app/utils/orgChart.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/requestAssistant.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 9, "fp": 27, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.3462, "f1": 0.2903, "f2": 0.3214, "f2_score": 32.1, "f3": 0.3333, "f3_score": 33.3, "tpr": 0.3462, "fpr": 1.0, "youden_j": -0.6538, "cvss_coverage": 1.0, "cvss_tp_weight": 66.4, "cvss_fp_weight": 163.2, "cvss_fn_weight": 96.3, "cvss_precision": 0.2892, "cvss_recall": 0.4081, "cvss_f3": 0.392, "cvss_f3_score": 39.2, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 16, "recall": 0.36 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/root.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": "app/routes/partner.benefits-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/allocation.ledger.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/notifications.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-835" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-262" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.documents.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 8, "fp": 27, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2286, "recall": 0.3077, "f1": 0.2623, "f2": 0.2878, "f2_score": 28.8, "f3": 0.2974, "f3_score": 29.7, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 57.6, "cvss_fp_weight": 169.0, "cvss_fn_weight": 105.1, "cvss_precision": 0.2542, "cvss_recall": 0.354, "cvss_f3": 0.3407, "cvss_f3_score": 34.1, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 17, "recall": 0.32 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/root.tsx", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/attachments.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.documents.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/dashboard.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.documents.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-262" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-835" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.requests.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/attachments.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/allocation.ledger.tsx", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 23, "fp": 14, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6216, "recall": 0.8846, "f1": 0.7302, "f2": 0.8156, "f2_score": 81.6, "f3": 0.8487, "f3_score": 84.9, "tpr": 0.8846, "fpr": 1.0, "youden_j": -0.1154, "cvss_coverage": 1.0, "cvss_tp_weight": 140.0, "cvss_fp_weight": 87.6, "cvss_fn_weight": 22.7, "cvss_precision": 0.6151, "cvss_recall": 0.8605, "cvss_f3": 0.8275, "cvss_f3_score": 82.7, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 22, "fp": 0, "fn": 3, "recall": 0.88 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": "app/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": "app/routes/manager.compensation.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": "app/routes/partner.benefits-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": "app/routes/profile.tsx", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": "app/utils/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/auth.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/directoryService.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": "app/utils/orgChart.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.policies.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/notifications.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/allocation.ledger.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/root.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.export.tsx", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-78" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 26, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.9231, "f1": 0.6316, "f2": 0.7792, "f2_score": 77.9, "f3": 0.8451, "f3_score": 84.5, "tpr": 0.9231, "fpr": 1.0, "youden_j": -0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 155.2, "cvss_fp_weight": 208.5, "cvss_fn_weight": 7.5, "cvss_precision": 0.4267, "cvss_recall": 0.9539, "cvss_f3": 0.849, "cvss_f3_score": 84.9, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 2, "recall": 0.92 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/db/seed.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/db/seed.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.documents.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employee.tasks.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.approvals.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/manager.compensation.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": "app/routes/manager.compensation.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.documents.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.documents.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": "app/routes/profile.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": "app/utils/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": "app/utils/allocationLinks.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": "app/utils/attachments.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/attachments.server.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/attachments.server.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": "app/utils/departmentSharedDrive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": "app/utils/documentConversion.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": "app/utils/payrollProvider.server.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyNotice.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/policyTemplateLibrary.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": "app/utils/profileSync.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": "app/routes/admin.import-export.tsx", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/reset-password.tsx", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": "app/utils/auth.server.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": "app/utils/orgChart.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/orgChart.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": "app/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": "app/routes/partner.benefits-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": "app/utils/approvalDelegation.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": "app/utils/auth.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": "drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 6, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 0.0385, "f1": 0.0606, "f2": 0.045, "f2_score": 4.5, "f3": 0.0415, "f3_score": 4.1, "tpr": 0.0385, "fpr": 1.0, "youden_j": -0.9615, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 44.0, "cvss_fn_weight": 153.9, "cvss_precision": 0.1666, "cvss_recall": 0.0541, "cvss_f3": 0.058, "cvss_f3_score": 5.8, "per_family": { "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 24, "recall": 0.04 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/entry.server.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.benefits-feed.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/partner.compensation-feed.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/profileSync.server.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-024", "file": "app/utils/reportRenderer.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reviewContext.server.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-legal-case-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 10, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4737, "recall": 0.36, "f1": 0.4091, "f2": 0.3782, "f2_score": 37.8, "f3": 0.3689, "f3_score": 36.9, "tpr": 0.36, "fpr": 1.0, "youden_j": -0.64, "cvss_coverage": 1.0, "cvss_tp_weight": 56.3, "cvss_fp_weight": 57.5, "cvss_fn_weight": 101.9, "cvss_precision": 0.4949, "cvss_recall": 0.3559, "cvss_f3": 0.3662, "cvss_f3_score": 36.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 15, "recall": 0.3182 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/portal.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/staffDirectory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 7, "fp": 14, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.28, "f1": 0.3043, "f2": 0.2893, "f2_score": 28.9, "f3": 0.2846, "f3_score": 28.5, "tpr": 0.28, "fpr": 1.0, "youden_j": -0.72, "cvss_coverage": 1.0, "cvss_tp_weight": 49.3, "cvss_fp_weight": 82.8, "cvss_fn_weight": 108.9, "cvss_precision": 0.3733, "cvss_recall": 0.3116, "cvss_f3": 0.3169, "cvss_f3_score": 31.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 16, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/portal.server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/portal.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/staffDirectory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notificationPrefs.server.ts", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 158.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 10, "fp": 17, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3704, "recall": 0.4, "f1": 0.3846, "f2": 0.3937, "f2_score": 39.4, "f3": 0.3968, "f3_score": 39.7, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 66.9, "cvss_fp_weight": 107.6, "cvss_fn_weight": 91.3, "cvss_precision": 0.3834, "cvss_recall": 0.4229, "cvss_f3": 0.4186, "cvss_f3_score": 41.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 12, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/convert.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/staffDirectory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notificationPrefs.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/clientUpdateDrafting.server.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notifications.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/context.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/context.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 12, "fp": 33, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2667, "recall": 0.48, "f1": 0.3429, "f2": 0.4138, "f2_score": 41.4, "f3": 0.4444, "f3_score": 44.4, "tpr": 0.48, "fpr": 1.0, "youden_j": -0.52, "cvss_coverage": 1.0, "cvss_tp_weight": 79.9, "cvss_fp_weight": 173.9, "cvss_fn_weight": 78.3, "cvss_precision": 0.3149, "cvss_recall": 0.5051, "cvss_f3": 0.4763, "cvss_f3_score": 47.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 11, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/portal.server.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/convert.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-843" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/intake.server.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notificationPrefs.server.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notificationPrefs.server.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/staffDirectory.server.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/context.server.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/context.server.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notifications.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/portal.server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": "app/lib/scheduling.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/scheduling.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notifications.server.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": "app/routes/_app.search.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/clientUpdateDrafting.server.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 24, "fp": 11, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6857, "recall": 0.96, "f1": 0.8, "f2": 0.8889, "f2_score": 88.9, "f3": 0.9231, "f3_score": 92.3, "tpr": 0.96, "fpr": 1.0, "youden_j": -0.04, "cvss_coverage": 1.0, "cvss_tp_weight": 151.7, "cvss_fp_weight": 69.6, "cvss_fn_weight": 6.5, "cvss_precision": 0.6855, "cvss_recall": 0.9589, "cvss_f3": 0.9221, "cvss_f3_score": 92.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 1, "recall": 0.9545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": "app/lib/compliance.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": "app/lib/efiling.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": "app/lib/notifications.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": "app/lib/portal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": "app/lib/scheduling.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": "app/routes/_app.search.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/convert.server.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.matters.$id.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.edit.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 21, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.56, "f1": 0.4667, "f2": 0.5185, "f2_score": 51.9, "f3": 0.5385, "f3_score": 53.8, "tpr": 0.56, "fpr": 1.0, "youden_j": -0.44, "cvss_coverage": 1.0, "cvss_tp_weight": 86.8, "cvss_fp_weight": 132.9, "cvss_fn_weight": 71.4, "cvss_precision": 0.3951, "cvss_recall": 0.5487, "cvss_f3": 0.5281, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 10, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/archive.server.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/convert.server.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-294" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.documents.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.tasks.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.clients.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/intake.server.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": "app/lib/scheduling.server.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": "app/lib/efiling.server.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/efiling.server.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/logout.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 21, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5116, "recall": 0.88, "f1": 0.6471, "f2": 0.7692, "f2_score": 76.9, "f3": 0.8209, "f3_score": 82.1, "tpr": 0.88, "fpr": 1.0, "youden_j": -0.12, "cvss_coverage": 1.0, "cvss_tp_weight": 139.4, "cvss_fp_weight": 121.2, "cvss_fn_weight": 18.8, "cvss_precision": 0.5349, "cvss_recall": 0.8812, "cvss_f3": 0.8276, "cvss_f3_score": 82.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 3, "recall": 0.8636 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": "app/lib/compliance.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/convert.server.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": "app/lib/efiling.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": "app/lib/notifications.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": "app/lib/portal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": "app/lib/scheduling.server.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": "app/routes/_app.search.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.documents.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.edit.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/staffDirectory.server.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.admin.import-export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/register.tsx", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/logout.tsx", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.clients.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.clients.$id.tsx", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 22, "fp": 34, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3929, "recall": 0.88, "f1": 0.5432, "f2": 0.7051, "f2_score": 70.5, "f3": 0.7829, "f3_score": 78.3, "tpr": 0.88, "fpr": 1.0, "youden_j": -0.12, "cvss_coverage": 1.0, "cvss_tp_weight": 142.6, "cvss_fp_weight": 251.0, "cvss_fn_weight": 15.6, "cvss_precision": 0.3623, "cvss_recall": 0.9014, "cvss_f3": 0.7846, "cvss_f3_score": 78.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 2, "recall": 0.9091 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/activityLog.server.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": "app/lib/archive.server.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/auth.server.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": "app/lib/compliance.server.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": "app/lib/compliance.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": "app/lib/convert.server.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/directorySync.server.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": "app/lib/efiling.server.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": "app/lib/feeEstimate.server.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/noticeTemplates.server.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/notificationPrefs.server.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": "app/lib/portal.server.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/session.server.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.matters.$id.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.matters.$id.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.matters.$id.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.clients.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.clients.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.search.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": "app/lib/intake.server.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": "app/lib/scheduling.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/scheduling.server.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": "app/lib/clientPortal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": "app/lib/delegateInvite.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": "app/lib/notifications.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": "app/lib/portal.server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": "app/lib/session.server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.matters.$id.edit.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.client.messages.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": "app/routes/_app.deadlines.tsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 5, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 31.6, "cvss_fn_weight": 158.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 22, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "Dockerfile", "cwe": "CWE-250" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/intake.server.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/kioskLayout.server.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 7, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5625, "recall": 0.3, "f1": 0.3913, "f2": 0.3309, "f2_score": 33.1, "f3": 0.3147, "f3_score": 31.5, "tpr": 0.3, "fpr": 1.0, "youden_j": -0.7, "cvss_coverage": 1.0, "cvss_tp_weight": 68.4, "cvss_fp_weight": 41.1, "cvss_fn_weight": 107.7, "cvss_precision": 0.6247, "cvss_recall": 0.3884, "cvss_f3": 0.4037, "cvss_f3_score": 40.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 19, "recall": 0.3214 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 10, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5652, "recall": 0.4333, "f1": 0.4906, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4437, "f3_score": 44.4, "tpr": 0.4333, "fpr": 1.0, "youden_j": -0.5667, "cvss_coverage": 1.0, "cvss_tp_weight": 94.1, "cvss_fp_weight": 48.0, "cvss_fn_weight": 82.0, "cvss_precision": 0.6624, "cvss_recall": 0.5344, "cvss_f3": 0.5449, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 16, "recall": 0.4286 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 30, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 176.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 28, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 12, "fp": 12, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4, "f1": 0.4444, "f2": 0.4167, "f2_score": 41.7, "f3": 0.4082, "f3_score": 40.8, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 86.0, "cvss_fp_weight": 70.4, "cvss_fn_weight": 90.1, "cvss_precision": 0.5497, "cvss_recall": 0.4884, "cvss_f3": 0.4939, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 17, "recall": 0.3929 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 15, "fp": 25, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.5, "f1": 0.4286, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4839, "f3_score": 48.4, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 105.4, "cvss_fp_weight": 136.0, "cvss_fn_weight": 70.7, "cvss_precision": 0.4366, "cvss_recall": 0.5985, "cvss_f3": 0.5771, "cvss_f3_score": 57.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 14, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/customers.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/db/seed.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 17, "fp": 55, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2361, "recall": 0.5667, "f1": 0.3333, "f2": 0.4427, "f2_score": 44.3, "f3": 0.4971, "f3_score": 49.7, "tpr": 0.5667, "fpr": 1.0, "youden_j": -0.4333, "cvss_coverage": 1.0, "cvss_tp_weight": 111.7, "cvss_fp_weight": 306.7, "cvss_fn_weight": 64.4, "cvss_precision": 0.2669, "cvss_recall": 0.6343, "cvss_f3": 0.5576, "cvss_f3_score": 55.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 13, "recall": 0.5357 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/middleware.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/customers.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/audit.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/proofs.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 31, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3261, "recall": 0.5, "f1": 0.3947, "f2": 0.4518, "f2_score": 45.2, "f3": 0.4747, "f3_score": 47.5, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 100.8, "cvss_fp_weight": 182.0, "cvss_fn_weight": 75.3, "cvss_precision": 0.3565, "cvss_recall": 0.5724, "cvss_f3": 0.5397, "cvss_f3_score": 54.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 14, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/middleware.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/routes/customers.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/customers.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/search.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/audit.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 16, "fp": 51, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2388, "recall": 0.5333, "f1": 0.3299, "f2": 0.4278, "f2_score": 42.8, "f3": 0.4748, "f3_score": 47.5, "tpr": 0.5333, "fpr": 1.0, "youden_j": -0.4667, "cvss_coverage": 1.0, "cvss_tp_weight": 105.8, "cvss_fp_weight": 294.0, "cvss_fn_weight": 70.3, "cvss_precision": 0.2646, "cvss_recall": 0.6008, "cvss_f3": 0.5331, "cvss_f3_score": 53.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 14, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/middleware.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/routes/customers.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/customers.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/audit.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/stores/auth.ts", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 29, "fp": 52, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.358, "recall": 0.9667, "f1": 0.5225, "f2": 0.7214, "f2_score": 72.1, "f3": 0.8262, "f3_score": 82.6, "tpr": 0.9667, "fpr": 1.0, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 171.3, "cvss_fp_weight": 391.0, "cvss_fn_weight": 4.8, "cvss_precision": 0.3046, "cvss_recall": 0.9727, "cvss_f3": 0.7978, "cvss_f3_score": 79.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 1, "recall": 0.9643 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": "backend/src/routes/auth.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/routes/customers.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/proofs.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/routes.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/services/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/customers.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": "backend/src/db/migrate.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/carrierSync.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 20, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1304, "recall": 0.1, "f1": 0.1132, "f2": 0.1049, "f2_score": 10.5, "f3": 0.1024, "f3_score": 10.2, "tpr": 0.1, "fpr": 1.0, "youden_j": -0.9, "cvss_coverage": 1.0, "cvss_tp_weight": 22.9, "cvss_fp_weight": 121.0, "cvss_fn_weight": 153.2, "cvss_precision": 0.1591, "cvss_recall": 0.13, "cvss_f3": 0.1325, "cvss_f3_score": 13.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 25, "recall": 0.1071 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proofs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 9, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4375, "recall": 0.2692, "f1": 0.3333, "f2": 0.2917, "f2_score": 29.2, "f3": 0.28, "f3_score": 28.0, "tpr": 0.2692, "fpr": 1.0, "youden_j": -0.7308, "cvss_coverage": 1.0, "cvss_tp_weight": 49.6, "cvss_fp_weight": 62.4, "cvss_fn_weight": 130.6, "cvss_precision": 0.4429, "cvss_recall": 0.2752, "cvss_f3": 0.2861, "cvss_f3_score": 28.6, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 16, "recall": 0.3043 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 8, "fp": 23, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2581, "recall": 0.3077, "f1": 0.2807, "f2": 0.2963, "f2_score": 29.6, "f3": 0.3019, "f3_score": 30.2, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 60.9, "cvss_fp_weight": 146.5, "cvss_fn_weight": 119.3, "cvss_precision": 0.2936, "cvss_recall": 0.338, "cvss_f3": 0.3329, "cvss_f3_score": 33.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 15, "recall": 0.3478 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 180.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 23, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 11, "fp": 35, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2391, "recall": 0.4231, "f1": 0.3056, "f2": 0.3667, "f2_score": 36.7, "f3": 0.3929, "f3_score": 39.3, "tpr": 0.4231, "fpr": 1.0, "youden_j": -0.5769, "cvss_coverage": 1.0, "cvss_tp_weight": 79.2, "cvss_fp_weight": 236.1, "cvss_fn_weight": 101.0, "cvss_precision": 0.2512, "cvss_recall": 0.4395, "cvss_f3": 0.4088, "cvss_f3_score": 40.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-77" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/auth.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 12, "fp": 13, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.48, "recall": 0.4615, "f1": 0.4706, "f2": 0.4651, "f2_score": 46.5, "f3": 0.4633, "f3_score": 46.3, "tpr": 0.4615, "fpr": 1.0, "youden_j": -0.5385, "cvss_coverage": 1.0, "cvss_tp_weight": 85.7, "cvss_fp_weight": 70.8, "cvss_fn_weight": 94.5, "cvss_precision": 0.5476, "cvss_recall": 0.4756, "cvss_f3": 0.4819, "cvss_f3_score": 48.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 8, "fp": 28, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.3077, "f1": 0.2581, "f2": 0.2857, "f2_score": 28.6, "f3": 0.2963, "f3_score": 29.6, "tpr": 0.3077, "fpr": 1.0, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 54.6, "cvss_fp_weight": 194.1, "cvss_fn_weight": 125.6, "cvss_precision": 0.2196, "cvss_recall": 0.303, "cvss_f3": 0.2919, "cvss_f3_score": 29.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 6, "fp": 0, "fn": 17, "recall": 0.2609 }, "medium": { "tp": 2, "fp": 0, "fn": 1, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/product.routes.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/context/AuthContext.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.routes.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 22, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3714, "recall": 0.5, "f1": 0.4262, "f2": 0.4676, "f2_score": 46.8, "f3": 0.4833, "f3_score": 48.3, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 93.8, "cvss_fp_weight": 152.5, "cvss_fn_weight": 86.4, "cvss_precision": 0.3809, "cvss_recall": 0.5205, "cvss_f3": 0.5021, "cvss_f3_score": 50.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 11, "recall": 0.5217 }, "medium": { "tp": 1, "fp": 0, "fn": 2, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-837" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/product.routes.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/dispute.routes.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 14, "fp": 21, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.5385, "f1": 0.459, "f2": 0.5036, "f2_score": 50.4, "f3": 0.5204, "f3_score": 52.0, "tpr": 0.5385, "fpr": 1.0, "youden_j": -0.4615, "cvss_coverage": 1.0, "cvss_tp_weight": 100.3, "cvss_fp_weight": 145.5, "cvss_fn_weight": 79.9, "cvss_precision": 0.408, "cvss_recall": 0.5566, "cvss_f3": 0.537, "cvss_f3_score": 53.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 12, "recall": 0.4783 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/staffDirectoryController.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-1427" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 24, "fp": 56, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3, "recall": 0.9231, "f1": 0.4528, "f2": 0.6522, "f2_score": 65.2, "f3": 0.7643, "f3_score": 76.4, "tpr": 0.9231, "fpr": 1.0, "youden_j": -0.0769, "cvss_coverage": 1.0, "cvss_tp_weight": 169.5, "cvss_fp_weight": 404.5, "cvss_fn_weight": 10.7, "cvss_precision": 0.2953, "cvss_recall": 0.9406, "cvss_f3": 0.7719, "cvss_f3_score": 77.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 2, "recall": 0.913 }, "medium": { "tp": 3, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": "server/src/controllers/adminController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": "server/src/controllers/orderController.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": "server/src/controllers/userController.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": "server/src/middleware/partnerFeed.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": "server/src/controllers/userController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": "server/src/controllers/productController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/order.routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/review.routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/vendor.routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": "server/src/controllers/adminController.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": "server/src/controllers/authController.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": "server/src/controllers/vendorController.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": "server/src/middleware/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": "server/src/routes/webhook.routes.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 39, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1136, "recall": 0.1923, "f1": 0.1429, "f2": 0.1689, "f2_score": 16.9, "f3": 0.1799, "f3_score": 18.0, "tpr": 0.1923, "fpr": 1.0, "youden_j": -0.8077, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 253.6, "cvss_fn_weight": 142.4, "cvss_precision": 0.1297, "cvss_recall": 0.2098, "cvss_f3": 0.1976, "cvss_f3_score": 19.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 18, "recall": 0.2174 }, "medium": { "tp": 0, "fp": 0, "fn": 3, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/adminController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/categoryController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-007", "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/disputeController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/orderController.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-011", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-012", "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/productController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-014", "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-016", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-306" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 2, "fp": 15, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1176, "recall": 0.1053, "f1": 0.1111, "f2": 0.1075, "f2_score": 10.8, "f3": 0.1064, "f3_score": 10.6, "tpr": 0.1053, "fpr": 1.0, "youden_j": -0.8947, "cvss_coverage": 1.0, "cvss_tp_weight": 14.7, "cvss_fp_weight": 91.9, "cvss_fn_weight": 101.7, "cvss_precision": 0.1379, "cvss_recall": 0.1263, "cvss_f3": 0.1274, "cvss_f3_score": 12.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 14, "recall": 0.125 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notification.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 6, "fp": 13, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3158, "recall": 0.3158, "f1": 0.3158, "f2": 0.3158, "f2_score": 31.6, "f3": 0.3158, "f3_score": 31.6, "tpr": 0.3158, "fpr": 1.0, "youden_j": -0.6842, "cvss_coverage": 1.0, "cvss_tp_weight": 46.2, "cvss_fp_weight": 68.4, "cvss_fn_weight": 70.2, "cvss_precision": 0.4032, "cvss_recall": 0.3969, "cvss_f3": 0.3975, "cvss_f3_score": 39.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 116.4, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 8, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 14, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3913, "recall": 0.4737, "f1": 0.4286, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4639, "f3_score": 46.4, "tpr": 0.4737, "fpr": 1.0, "youden_j": -0.5263, "cvss_coverage": 1.0, "cvss_tp_weight": 60.3, "cvss_fp_weight": 85.8, "cvss_fn_weight": 56.1, "cvss_precision": 0.4128, "cvss_recall": 0.518, "cvss_f3": 0.5052, "cvss_f3_score": 50.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notification.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/message-search.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/response-drafting.service.ts", "cwe": "CWE-1426" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 13, "fp": 48, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2131, "recall": 0.6842, "f1": 0.325, "f2": 0.4745, "f2_score": 47.4, "f3": 0.5603, "f3_score": 56.0, "tpr": 0.6842, "fpr": 1.0, "youden_j": -0.3158, "cvss_coverage": 1.0, "cvss_tp_weight": 84.5, "cvss_fp_weight": 282.8, "cvss_fn_weight": 31.9, "cvss_precision": 0.2301, "cvss_recall": 0.7259, "cvss_f3": 0.5972, "cvss_f3_score": 59.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notification.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notification.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/entities/User.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/entities/User.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/server.ts", "cwe": "CWE-538" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/data-source.ts", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 10, "fp": 37, "fn": 9, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2128, "recall": 0.5263, "f1": 0.303, "f2": 0.4065, "f2_score": 40.7, "f3": 0.4587, "f3_score": 45.9, "tpr": 0.5263, "fpr": 1.0, "youden_j": -0.4737, "cvss_coverage": 1.0, "cvss_tp_weight": 65.1, "cvss_fp_weight": 215.4, "cvss_fn_weight": 51.3, "cvss_precision": 0.2321, "cvss_recall": 0.5593, "cvss_f3": 0.4902, "cvss_f3_score": 49.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/data-source.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/api-keys.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 13, "fp": 39, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.6842, "f1": 0.3662, "f2": 0.5078, "f2_score": 50.8, "f3": 0.583, "f3_score": 58.3, "tpr": 0.6842, "fpr": 1.0, "youden_j": -0.3158, "cvss_coverage": 1.0, "cvss_tp_weight": 85.0, "cvss_fp_weight": 238.9, "cvss_fn_weight": 31.4, "cvss_precision": 0.2624, "cvss_recall": 0.7302, "cvss_f3": 0.6197, "cvss_f3_score": 62.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/seed.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/server.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/json-api.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/services/message-search.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-789" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 116.4, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 16, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/routes/auth.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/services/message-search.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-489" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 16, "fp": 67, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1928, "recall": 0.8421, "f1": 0.3137, "f2": 0.5031, "f2_score": 50.3, "f3": 0.6299, "f3_score": 63.0, "tpr": 0.8421, "fpr": 1.0, "youden_j": -0.1579, "cvss_coverage": 1.0, "cvss_tp_weight": 99.2, "cvss_fp_weight": 510.0, "cvss_fn_weight": 17.2, "cvss_precision": 0.1628, "cvss_recall": 0.8522, "cvss_f3": 0.5987, "cvss_f3_score": 59.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import-export.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/json-api.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/properties.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/server.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notification.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/services/portal-sync.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/services/message-search.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/routes/inspections.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/server.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/services/lease.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 36, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0769, "recall": 0.1579, "f1": 0.1034, "f2": 0.1304, "f2_score": 13.0, "f3": 0.1429, "f3_score": 14.3, "tpr": 0.1579, "fpr": 1.0, "youden_j": -0.8421, "cvss_coverage": 1.0, "cvss_tp_weight": 24.1, "cvss_fp_weight": 220.5, "cvss_fn_weight": 92.3, "cvss_precision": 0.0985, "cvss_recall": 0.207, "cvss_f3": 0.1865, "cvss_f3_score": 18.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 13, "recall": 0.1875 }, "medium": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/admin.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/lease-documents.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tenants.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/units.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/file.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/lease.service.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/packet.service.ts", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-489" } ] }, "sonarqube": null }, "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 7, "fp": 8, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.3684, "f1": 0.4118, "f2": 0.3846, "f2_score": 38.5, "f3": 0.3763, "f3_score": 37.6, "tpr": 0.3684, "fpr": 1.0, "youden_j": -0.6316, "cvss_coverage": 1.0, "cvss_tp_weight": 44.1, "cvss_fp_weight": 53.7, "cvss_fn_weight": 83.5, "cvss_precision": 0.4508, "cvss_recall": 0.3456, "cvss_f3": 0.3539, "cvss_f3_score": 35.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 7, "fp": 0, "fn": 12, "recall": 0.3684 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 8, "fp": 8, "fn": 11, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.4211, "f1": 0.4571, "f2": 0.4348, "f2_score": 43.5, "f3": 0.4278, "f3_score": 42.8, "tpr": 0.4211, "fpr": 1.0, "youden_j": -0.5789, "cvss_coverage": 1.0, "cvss_tp_weight": 47.4, "cvss_fp_weight": 53.7, "cvss_fn_weight": 80.2, "cvss_precision": 0.4687, "cvss_recall": 0.3715, "cvss_f3": 0.3793, "cvss_f3_score": 37.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 8, "fp": 0, "fn": 11, "recall": 0.4211 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 127.6, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 19, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 9, "fp": 12, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.4737, "f1": 0.45, "f2": 0.4639, "f2_score": 46.4, "f3": 0.4688, "f3_score": 46.9, "tpr": 0.4737, "fpr": 1.0, "youden_j": -0.5263, "cvss_coverage": 1.0, "cvss_tp_weight": 53.7, "cvss_fp_weight": 80.6, "cvss_fn_weight": 73.9, "cvss_precision": 0.3999, "cvss_recall": 0.4208, "cvss_f3": 0.4187, "cvss_f3_score": 41.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 10, "recall": 0.4737 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 9, "fp": 33, "fn": 10, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.4737, "f1": 0.2951, "f2": 0.3814, "f2_score": 38.1, "f3": 0.4225, "f3_score": 42.3, "tpr": 0.4737, "fpr": 1.0, "youden_j": -0.5263, "cvss_coverage": 1.0, "cvss_tp_weight": 53.7, "cvss_fp_weight": 209.2, "cvss_fn_weight": 73.9, "cvss_precision": 0.2043, "cvss_recall": 0.4208, "cvss_f3": 0.3805, "cvss_f3_score": 38.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 10, "recall": 0.4737 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.controller.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 12, "fp": 42, "fn": 7, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2222, "recall": 0.6316, "f1": 0.3288, "f2": 0.4615, "f2_score": 46.2, "f3": 0.5333, "f3_score": 53.3, "tpr": 0.6316, "fpr": 1.0, "youden_j": -0.3684, "cvss_coverage": 1.0, "cvss_tp_weight": 78.0, "cvss_fp_weight": 263.4, "cvss_fn_weight": 49.6, "cvss_precision": 0.2285, "cvss_recall": 0.6113, "cvss_f3": 0.5236, "cvss_f3_score": 52.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 7, "recall": 0.6316 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": "server/src/modules/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/replies/replies.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": "server/src/modules/portal/portal.module.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/audit/audit.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 39, "fn": 5, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2642, "recall": 0.7368, "f1": 0.3889, "f2": 0.5426, "f2_score": 54.3, "f3": 0.625, "f3_score": 62.5, "tpr": 0.7368, "fpr": 1.0, "youden_j": -0.2632, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 261.9, "cvss_fn_weight": 36.1, "cvss_precision": 0.2589, "cvss_recall": 0.7171, "cvss_f3": 0.6093, "cvss_f3_score": 60.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 5, "recall": 0.7368 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": "server/prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/replies/replies.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/audit/audit.service.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 19, "fp": 42, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3115, "recall": 1.0, "f1": 0.475, "f2": 0.6934, "f2_score": 69.3, "f3": 0.819, "f3_score": 81.9, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 127.6, "cvss_fp_weight": 263.4, "cvss_fn_weight": 0.0, "cvss_precision": 0.3263, "cvss_recall": 1.0, "cvss_f3": 0.8289, "cvss_f3_score": 82.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": "server/src/modules/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/main.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "client/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/replies/replies.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": "server/src/modules/notes/notes.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": "server/src/modules/portal/portal.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/audit/audit.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-523" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 17, "fp": 35, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3269, "recall": 0.8947, "f1": 0.4789, "f2": 0.6641, "f2_score": 66.4, "f3": 0.7623, "f3_score": 76.2, "tpr": 0.8947, "fpr": 1.0, "youden_j": -0.1053, "cvss_coverage": 1.0, "cvss_tp_weight": 112.4, "cvss_fp_weight": 255.5, "cvss_fn_weight": 15.2, "cvss_precision": 0.3055, "cvss_recall": 0.8809, "cvss_f3": 0.7413, "cvss_f3_score": 74.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 2, "recall": 0.8947 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": "server/src/common/filters/http-exception.filter.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": "server/src/modules/customers/customers.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": "server/src/modules/portal/portal.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": "server/src/modules/sla/sla.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/notifications/notifications.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/auth/auth.service.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": "server/src/modules/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": "server/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": "server/src/modules/portal/portal.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": "server/src/modules/portal/portal.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 3, "fp": 14, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1765, "recall": 0.1579, "f1": 0.1667, "f2": 0.1613, "f2_score": 16.1, "f3": 0.1596, "f3_score": 16.0, "tpr": 0.1579, "fpr": 1.0, "youden_j": -0.8421, "cvss_coverage": 1.0, "cvss_tp_weight": 21.5, "cvss_fp_weight": 94.0, "cvss_fn_weight": 106.1, "cvss_precision": 0.1861, "cvss_recall": 0.1685, "cvss_f3": 0.1701, "cvss_f3_score": 17.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.0833 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 3, "fp": 0, "fn": 16, "recall": 0.1579 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/escalations/escalations.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-011", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-012", "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/import-export/import-export.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-013", "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-117" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v2-crm-saas-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 24, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.7778, "f1": 0.5833, "f2": 0.6863, "f2_score": 68.6, "f3": 0.7292, "f3_score": 72.9, "tpr": 0.7778, "fpr": 0.8571, "youden_j": -0.0794, "cvss_coverage": 1.0, "cvss_tp_weight": 127.9, "cvss_fp_weight": 116.3, "cvss_fn_weight": 34.6, "cvss_precision": 0.5237, "cvss_recall": 0.7871, "cvss_f3": 0.7494, "cvss_f3_score": 74.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-343", "file": "crm/core/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-741", "file": "crm/core/partner_console.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 11, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.6296, "f1": 0.6182, "f2": 0.625, "f2_score": 62.5, "f3": 0.6273, "f3_score": 62.7, "tpr": 0.6296, "fpr": 0.7333, "youden_j": -0.1037, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 38.7, "cvss_fn_weight": 55.5, "cvss_precision": 0.7344, "cvss_recall": 0.6585, "cvss_f3": 0.6653, "cvss_f3_score": 66.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-288" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.5185, "f1": 0.6087, "f2": 0.5512, "f2_score": 55.1, "f3": 0.5344, "f3_score": 53.4, "tpr": 0.5185, "fpr": 0.5556, "youden_j": -0.037, "cvss_coverage": 1.0, "cvss_tp_weight": 86.5, "cvss_fp_weight": 21.5, "cvss_fn_weight": 76.0, "cvss_precision": 0.8012, "cvss_recall": 0.5323, "cvss_f3": 0.5508, "cvss_f3_score": 55.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 12, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4444, "f1": 0.5333, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4598, "f3_score": 46.0, "tpr": 0.4444, "fpr": 0.6, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 74.2, "cvss_fp_weight": 17.2, "cvss_fn_weight": 88.3, "cvss_precision": 0.8116, "cvss_recall": 0.4566, "cvss_f3": 0.4775, "cvss_f3_score": 47.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7083, "recall": 0.6296, "f1": 0.6667, "f2": 0.6439, "f2_score": 64.4, "f3": 0.6367, "f3_score": 63.7, "tpr": 0.6296, "fpr": 0.6364, "youden_j": -0.0067, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 27.2, "cvss_fn_weight": 55.5, "cvss_precision": 0.7973, "cvss_recall": 0.6585, "cvss_f3": 0.6701, "cvss_f3_score": 67.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.3457, "f1": 0.4788, "f2": 0.3886, "f2_score": 38.9, "f3": 0.3658, "f3_score": 36.6, "tpr": 0.3457, "fpr": 0.3524, "youden_j": -0.0067, "cvss_coverage": 1.0, "cvss_tp_weight": 59.1, "cvss_fp_weight": 9.0, "cvss_fn_weight": 103.4, "cvss_precision": 0.8623, "cvss_recall": 0.3635, "cvss_f3": 0.3856, "cvss_f3_score": 38.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 1, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.2593, "f1": 0.4, "f2": 0.3017, "f2_score": 30.2, "f3": 0.2789, "f3_score": 27.9, "tpr": 0.2593, "fpr": 0.2, "youden_j": 0.0593, "cvss_coverage": 1.0, "cvss_tp_weight": 47.2, "cvss_fp_weight": 5.2, "cvss_fn_weight": 115.3, "cvss_precision": 0.9, "cvss_recall": 0.2905, "cvss_f3": 0.3116, "cvss_f3_score": 31.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 12, "recall": 0.2 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 4, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7665, "recall": 0.4815, "f1": 0.5911, "f2": 0.52, "f2_score": 52.0, "f3": 0.5, "f3_score": 50.0, "tpr": 0.4815, "fpr": 0.4947, "youden_j": -0.0132, "cvss_coverage": 1.0, "cvss_tp_weight": 79.9, "cvss_fp_weight": 17.8, "cvss_fn_weight": 82.6, "cvss_precision": 0.8211, "cvss_recall": 0.4915, "cvss_f3": 0.5119, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 7, "recall": 0.2222 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 9, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6186, "recall": 0.5556, "f1": 0.585, "f2": 0.5669, "f2_score": 56.7, "f3": 0.5611, "f3_score": 56.1, "tpr": 0.5556, "fpr": 0.6947, "youden_j": -0.1391, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 37.8, "cvss_fn_weight": 69.5, "cvss_precision": 0.7117, "cvss_recall": 0.5723, "cvss_f3": 0.5837, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 14, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.552, "recall": 0.5926, "f1": 0.5676, "f2": 0.5813, "f2_score": 58.1, "f3": 0.5867, "f3_score": 58.6, "tpr": 0.5926, "fpr": 0.7569, "youden_j": -0.1643, "cvss_coverage": 1.0, "cvss_tp_weight": 99.8, "cvss_fp_weight": 51.1, "cvss_fn_weight": 62.7, "cvss_precision": 0.6664, "cvss_recall": 0.614, "cvss_f3": 0.6184, "cvss_f3_score": 61.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 14, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5484, "recall": 0.6296, "f1": 0.5862, "f2": 0.6115, "f2_score": 61.2, "f3": 0.6204, "f3_score": 62.0, "tpr": 0.6296, "fpr": 0.7778, "youden_j": -0.1481, "cvss_coverage": 1.0, "cvss_tp_weight": 107.0, "cvss_fp_weight": 59.2, "cvss_fn_weight": 55.5, "cvss_precision": 0.644, "cvss_recall": 0.6585, "cvss_f3": 0.657, "cvss_f3_score": 65.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 17, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4827, "recall": 0.5926, "f1": 0.5315, "f2": 0.5663, "f2_score": 56.7, "f3": 0.5791, "f3_score": 57.9, "tpr": 0.5926, "fpr": 0.8095, "youden_j": -0.2169, "cvss_coverage": 1.0, "cvss_tp_weight": 101.3, "cvss_fp_weight": 65.4, "cvss_fn_weight": 61.2, "cvss_precision": 0.6064, "cvss_recall": 0.6236, "cvss_f3": 0.6217, "cvss_f3_score": 62.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.5185, "f1": 0.6364, "f2": 0.56, "f2_score": 56.0, "f3": 0.5385, "f3_score": 53.8, "tpr": 0.5185, "fpr": 0.4286, "youden_j": 0.0899, "cvss_coverage": 1.0, "cvss_tp_weight": 89.7, "cvss_fp_weight": 11.0, "cvss_fn_weight": 72.8, "cvss_precision": 0.8909, "cvss_recall": 0.552, "cvss_f3": 0.5738, "cvss_f3_score": 57.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 27, "fp": 18, "fn": 0, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 1.0, "f1": 0.75, "f2": 0.8824, "f2_score": 88.2, "f3": 0.9375, "f3_score": 93.8, "tpr": 1.0, "fpr": 0.8571, "youden_j": 0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 162.5, "cvss_fp_weight": 84.9, "cvss_fn_weight": 0.0, "cvss_precision": 0.6569, "cvss_recall": 1.0, "cvss_f3": 0.9504, "cvss_f3_score": 95.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 1, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-343", "file": "crm/core/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-650", "file": "crm/core/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-741", "file": "crm/core/partner_console.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": "crm/core/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/urls.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 10, "fp": 13, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4348, "recall": 0.3704, "f1": 0.4, "f2": 0.3817, "f2_score": 38.2, "f3": 0.3759, "f3_score": 37.6, "tpr": 0.3704, "fpr": 0.7647, "youden_j": -0.3943, "cvss_coverage": 1.0, "cvss_tp_weight": 69.2, "cvss_fp_weight": 68.1, "cvss_fn_weight": 93.3, "cvss_precision": 0.5038, "cvss_recall": 0.4258, "cvss_f3": 0.4325, "cvss_f3_score": 43.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 24, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.5926, "f1": 0.4776, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5654, "f3_score": 56.5, "tpr": 0.5926, "fpr": 0.8571, "youden_j": -0.2646, "cvss_coverage": 1.0, "cvss_tp_weight": 101.2, "cvss_fp_weight": 111.6, "cvss_fn_weight": 61.3, "cvss_precision": 0.4756, "cvss_recall": 0.6228, "cvss_f3": 0.6041, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/forms.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": "crm/core/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-497" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 27, "fp": 9, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 1.0, "f1": 0.8571, "f2": 0.9375, "f2_score": 93.8, "f3": 0.9677, "f3_score": 96.8, "tpr": 1.0, "fpr": 0.6923, "youden_j": 0.3077, "cvss_coverage": 1.0, "cvss_tp_weight": 162.5, "cvss_fp_weight": 37.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.8117, "cvss_recall": 1.0, "cvss_f3": 0.9773, "cvss_f3_score": 97.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 15, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-343", "file": "crm/core/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-650", "file": "crm/core/partner_console.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-741", "file": "crm/core/partner_console.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": "crm/core/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/models.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6926, "recall": 0.4815, "f1": 0.5664, "f2": 0.512, "f2_score": 51.2, "f3": 0.4962, "f3_score": 49.6, "tpr": 0.4815, "fpr": 0.5826, "youden_j": -0.1011, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 26.7, "cvss_fn_weight": 82.9, "cvss_precision": 0.7534, "cvss_recall": 0.49, "cvss_f3": 0.5076, "cvss_f3_score": 50.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 8, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.623, "recall": 0.4691, "f1": 0.5352, "f2": 0.4935, "f2_score": 49.4, "f3": 0.481, "f3_score": 48.1, "tpr": 0.4691, "fpr": 0.6566, "youden_j": -0.1874, "cvss_coverage": 1.0, "cvss_tp_weight": 80.0, "cvss_fp_weight": 24.4, "cvss_fn_weight": 82.5, "cvss_precision": 0.7742, "cvss_recall": 0.4925, "cvss_f3": 0.5108, "cvss_f3_score": 51.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 14, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4961, "recall": 0.4568, "f1": 0.4664, "f2": 0.4583, "f2_score": 45.8, "f3": 0.4572, "f3_score": 45.7, "tpr": 0.4568, "fpr": 0.7461, "youden_j": -0.2893, "cvss_coverage": 1.0, "cvss_tp_weight": 78.5, "cvss_fp_weight": 52.8, "cvss_fn_weight": 84.0, "cvss_precision": 0.6279, "cvss_recall": 0.4833, "cvss_f3": 0.4924, "cvss_f3_score": 49.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 10, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-730", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 14, "fp": 11, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.56, "recall": 0.5185, "f1": 0.5385, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5224, "f3_score": 52.2, "tpr": 0.5185, "fpr": 0.7333, "youden_j": -0.2148, "cvss_coverage": 1.0, "cvss_tp_weight": 86.5, "cvss_fp_weight": 38.7, "cvss_fn_weight": 76.0, "cvss_precision": 0.6909, "cvss_recall": 0.5323, "cvss_f3": 0.5448, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 5, "recall": 0.4444 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 8, "recall": 0.4667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-302" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 13, "fp": 15, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4643, "recall": 0.4815, "f1": 0.4727, "f2": 0.4779, "f2_score": 47.8, "f3": 0.4797, "f3_score": 48.0, "tpr": 0.4815, "fpr": 0.7895, "youden_j": -0.308, "cvss_coverage": 1.0, "cvss_tp_weight": 79.8, "cvss_fp_weight": 78.5, "cvss_fn_weight": 82.7, "cvss_precision": 0.5041, "cvss_recall": 0.4911, "cvss_f3": 0.4923, "cvss_f3_score": 49.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 19, "fp": 66, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2235, "recall": 0.7037, "f1": 0.3393, "f2": 0.4922, "f2_score": 49.2, "f3": 0.5793, "f3_score": 57.9, "tpr": 0.7037, "fpr": 0.9429, "youden_j": -0.2392, "cvss_coverage": 1.0, "cvss_tp_weight": 118.4, "cvss_fp_weight": 442.5, "cvss_fn_weight": 44.1, "cvss_precision": 0.2111, "cvss_recall": 0.7286, "cvss_f3": 0.5852, "cvss_f3_score": 58.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 6, "recall": 0.6 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 35, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3636, "recall": 0.7407, "f1": 0.4878, "f2": 0.6135, "f2_score": 61.3, "f3": 0.6711, "f3_score": 67.1, "tpr": 0.7407, "fpr": 0.8974, "youden_j": -0.1567, "cvss_coverage": 1.0, "cvss_tp_weight": 124.9, "cvss_fp_weight": 244.0, "cvss_fn_weight": 37.6, "cvss_precision": 0.3386, "cvss_recall": 0.7686, "cvss_f3": 0.682, "cvss_f3_score": 68.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7222 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 2, "recall": 0.7778 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 4, "recall": 0.7333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 1, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.0741, "f1": 0.1333, "f2": 0.0901, "f2_score": 9.0, "f3": 0.0813, "f3_score": 8.1, "tpr": 0.0741, "fpr": 0.2, "youden_j": -0.1259, "cvss_coverage": 1.0, "cvss_tp_weight": 16.3, "cvss_fp_weight": 8.0, "cvss_fn_weight": 146.2, "cvss_precision": 0.6708, "cvss_recall": 0.1003, "cvss_f3": 0.1096, "cvss_f3_score": 11.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 14, "recall": 0.0667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-093", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-682", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-700", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-719", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-730", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 69, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2333, "recall": 0.7778, "f1": 0.359, "f2": 0.5303, "f2_score": 53.0, "f3": 0.6306, "f3_score": 63.1, "tpr": 0.7778, "fpr": 0.9583, "youden_j": -0.1806, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 462.0, "cvss_fn_weight": 32.2, "cvss_precision": 0.22, "cvss_recall": 0.8018, "cvss_f3": 0.6341, "cvss_f3_score": 63.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 1, "fn": 4, "precision": 0.9333, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/crm/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/audit_log.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_list.html", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_list.html", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/webhook_form.html", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 25, "fp": 10, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.9259, "f1": 0.8065, "f2": 0.8741, "f2_score": 87.4, "f3": 0.8993, "f3_score": 89.9, "tpr": 0.9259, "fpr": 0.7143, "youden_j": 0.2116, "cvss_coverage": 1.0, "cvss_tp_weight": 153.6, "cvss_fp_weight": 70.0, "cvss_fn_weight": 8.9, "cvss_precision": 0.6869, "cvss_recall": 0.9452, "cvss_f3": 0.911, "cvss_f3_score": 91.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 1, "recall": 0.8889 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 1, "recall": 0.9333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-343", "file": "crm/core/partner_console.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-650", "file": "crm/core/partner_console.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-741", "file": "crm/core/partner_console.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": "crm/core/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/models.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 20, "fp": 23, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4651, "recall": 0.7407, "f1": 0.5714, "f2": 0.6623, "f2_score": 66.2, "f3": 0.6993, "f3_score": 69.9, "tpr": 0.7407, "fpr": 0.8519, "youden_j": -0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 121.6, "cvss_fp_weight": 134.0, "cvss_fn_weight": 40.9, "cvss_precision": 0.4757, "cvss_recall": 0.7483, "cvss_f3": 0.7078, "cvss_f3_score": 70.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 4, "recall": 0.5556 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": "crm/crm/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 21, "fp": 94, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1826, "recall": 0.7778, "f1": 0.2958, "f2": 0.4709, "f2_score": 47.1, "f3": 0.5866, "f3_score": 58.7, "tpr": 0.7778, "fpr": 0.9691, "youden_j": -0.1913, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 604.5, "cvss_fn_weight": 32.2, "cvss_precision": 0.1773, "cvss_recall": 0.8018, "cvss_f3": 0.593, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 1, "fn": 4, "precision": 0.9333, "recall": 0.7778 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 3, "recall": 0.6667 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 1, "fn": 3, "recall": 0.8 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-139", "file": "crm/core/partner_console.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-207", "file": "crm/core/partner_console.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-690", "file": "crm/core/partner_console.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": "crm/crm/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/audit_log.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-1022" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_detail.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_list.html", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/organization_list.html", "cwe": "CWE-88" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/crm/webhook_form.html", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 4, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7084, "recall": 0.3704, "f1": 0.4842, "f2": 0.4086, "f2_score": 40.8, "f3": 0.3885, "f3_score": 38.8, "tpr": 0.3704, "fpr": 0.5, "youden_j": -0.1296, "cvss_coverage": 1.0, "cvss_tp_weight": 65.5, "cvss_fp_weight": 18.6, "cvss_fn_weight": 97.0, "cvss_precision": 0.778, "cvss_recall": 0.4027, "cvss_f3": 0.4227, "cvss_f3_score": 42.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-730", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 13, "fp": 7, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.4815, "f1": 0.5532, "f2": 0.5078, "f2_score": 50.8, "f3": 0.4943, "f3_score": 49.4, "tpr": 0.4815, "fpr": 0.6364, "youden_j": -0.1549, "cvss_coverage": 1.0, "cvss_tp_weight": 85.2, "cvss_fp_weight": 36.7, "cvss_fn_weight": 77.3, "cvss_precision": 0.699, "cvss_recall": 0.5243, "cvss_f3": 0.5377, "cvss_f3_score": 53.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 8, "fp": 0, "fn": 7, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": "crm/core/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": "crm/core/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-092", "file": "crm/core/partner_console.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/view.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4444, "f1": 0.5333, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4598, "f3_score": 46.0, "tpr": 0.4444, "fpr": 0.6, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 77.9, "cvss_fp_weight": 22.0, "cvss_fn_weight": 84.6, "cvss_precision": 0.78, "cvss_recall": 0.4794, "cvss_f3": 0.4986, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 6, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 9, "recall": 0.4 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-249", "file": "crm/core/partner_console.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-719", "file": "crm/core/partner_console.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-660", "file": "crm/core/partner_console.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-670", "file": "crm/core/partner_console.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-091", "file": "crm/core/partner_console.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": ".env.example", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 38, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1163, "recall": 0.1852, "f1": 0.1429, "f2": 0.1656, "f2_score": 16.6, "f3": 0.1748, "f3_score": 17.5, "tpr": 0.1852, "fpr": 0.9048, "youden_j": -0.7196, "cvss_coverage": 1.0, "cvss_tp_weight": 36.1, "cvss_fp_weight": 107.0, "cvss_fn_weight": 126.4, "cvss_precision": 0.2523, "cvss_recall": 0.2222, "cvss_f3": 0.2248, "cvss_f3_score": 22.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 13, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-682", "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-093", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-719", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 21, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.84, "youden_j": -0.84, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 110.1, "cvss_fn_weight": 162.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 9, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 15, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/accounts/forms.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/core/partner_console.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/crm/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/accounts/login.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/accounts/password_change.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-crm-saas-django/crm/templates/crm/webhook_form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-093", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-184", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-287", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-682", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-700", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-710", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-719", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-730", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 68, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0811, "recall": 0.2222, "f1": 0.1188, "f2": 0.1648, "f2_score": 16.5, "f3": 0.1893, "f3_score": 18.9, "tpr": 0.2222, "fpr": 0.9444, "youden_j": -0.7222, "cvss_coverage": 1.0, "cvss_tp_weight": 36.2, "cvss_fp_weight": 365.0, "cvss_fn_weight": 126.3, "cvss_precision": 0.0902, "cvss_recall": 0.2228, "cvss_f3": 0.1942, "cvss_f3_score": 19.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1111 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 8, "recall": 0.1111 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 11, "recall": 0.2667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-093", "file": "crm/core/partner_console.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-184", "file": "crm/core/partner_console.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-287", "file": "crm/core/partner_console.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-700", "file": "crm/core/partner_console.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-710", "file": "crm/core/partner_console.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-730", "file": "crm/core/partner_console.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/partner_console.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/crm/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "crm/templates/base_public.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-091", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-092", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-139", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-207", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-249", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-343", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-650", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-660", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-670", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-682", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-690", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-719", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-741", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-fp-004", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-crm-saas-django-enrich-008", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-education-lms-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 29, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.42, "recall": 0.75, "f1": 0.5385, "f2": 0.6481, "f2_score": 64.8, "f3": 0.6954, "f3_score": 69.5, "tpr": 0.75, "fpr": 0.8788, "youden_j": -0.1288, "cvss_coverage": 1.0, "cvss_tp_weight": 134.4, "cvss_fp_weight": 148.7, "cvss_fn_weight": 40.6, "cvss_precision": 0.4748, "cvss_recall": 0.768, "cvss_f3": 0.7233, "cvss_f3_score": 72.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-344", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-742", "file": "lms/course_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-348" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 7, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.5, "f1": 0.5714, "f2": 0.5263, "f2_score": 52.6, "f3": 0.5128, "f3_score": 51.3, "tpr": 0.5, "fpr": 0.6364, "youden_j": -0.1364, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 28.3, "cvss_fn_weight": 79.8, "cvss_precision": 0.7706, "cvss_recall": 0.544, "cvss_f3": 0.5605, "cvss_f3_score": 56.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 7, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6316, "recall": 0.4286, "f1": 0.5106, "f2": 0.458, "f2_score": 45.8, "f3": 0.4428, "f3_score": 44.3, "tpr": 0.4286, "fpr": 0.6364, "youden_j": -0.2078, "cvss_coverage": 1.0, "cvss_tp_weight": 81.2, "cvss_fp_weight": 38.3, "cvss_fn_weight": 93.8, "cvss_precision": 0.6796, "cvss_recall": 0.464, "cvss_f3": 0.4792, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.5, "f1": 0.6222, "f2": 0.5426, "f2_score": 54.3, "f3": 0.5204, "f3_score": 52.0, "tpr": 0.5, "fpr": 0.4286, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 96.7, "cvss_fp_weight": 16.4, "cvss_fn_weight": 78.3, "cvss_precision": 0.8549, "cvss_recall": 0.5526, "cvss_f3": 0.5728, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 15, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5312, "recall": 0.6071, "f1": 0.5667, "f2": 0.5903, "f2_score": 59.0, "f3": 0.5986, "f3_score": 59.9, "tpr": 0.6071, "fpr": 0.7895, "youden_j": -0.1823, "cvss_coverage": 1.0, "cvss_tp_weight": 110.4, "cvss_fp_weight": 82.0, "cvss_fn_weight": 64.6, "cvss_precision": 0.5737, "cvss_recall": 0.6309, "cvss_f3": 0.6246, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 9, "fp": 3, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7811, "recall": 0.3333, "f1": 0.4632, "f2": 0.3751, "f2_score": 37.5, "f3": 0.3529, "f3_score": 35.3, "tpr": 0.3333, "fpr": 0.3778, "youden_j": -0.0445, "cvss_coverage": 1.0, "cvss_tp_weight": 64.3, "cvss_fp_weight": 16.4, "cvss_fn_weight": 110.7, "cvss_precision": 0.8136, "cvss_recall": 0.3673, "cvss_f3": 0.3881, "cvss_f3_score": 38.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 10, "fp": 2, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.3571, "f1": 0.5, "f2": 0.4032, "f2_score": 40.3, "f3": 0.3788, "f3_score": 37.9, "tpr": 0.3571, "fpr": 0.3333, "youden_j": 0.0238, "cvss_coverage": 1.0, "cvss_tp_weight": 65.6, "cvss_fp_weight": 6.0, "cvss_fn_weight": 109.4, "cvss_precision": 0.9166, "cvss_recall": 0.3749, "cvss_f3": 0.3984, "cvss_f3_score": 39.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 5, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7102, "recall": 0.4524, "f1": 0.5515, "f2": 0.4873, "f2_score": 48.7, "f3": 0.4692, "f3_score": 46.9, "tpr": 0.4524, "fpr": 0.5333, "youden_j": -0.0809, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 25.9, "cvss_fn_weight": 88.4, "cvss_precision": 0.7765, "cvss_recall": 0.4947, "cvss_f3": 0.5131, "cvss_f3_score": 51.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 15, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4976, "recall": 0.5357, "f1": 0.5151, "f2": 0.527, "f2_score": 52.7, "f3": 0.5313, "f3_score": 53.1, "tpr": 0.5357, "fpr": 0.7895, "youden_j": -0.2538, "cvss_coverage": 1.0, "cvss_tp_weight": 100.0, "cvss_fp_weight": 65.6, "cvss_fn_weight": 75.0, "cvss_precision": 0.6034, "cvss_recall": 0.5714, "cvss_f3": 0.5744, "cvss_f3_score": 57.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-603" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 9, "fp": 15, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2529, "recall": 0.3333, "f1": 0.2876, "f2": 0.3134, "f2_score": 31.3, "f3": 0.323, "f3_score": 32.3, "tpr": 0.3333, "fpr": 0.5674, "youden_j": -0.234, "cvss_coverage": 1.0, "cvss_tp_weight": 63.0, "cvss_fp_weight": 45.8, "cvss_fn_weight": 112.0, "cvss_precision": 0.386, "cvss_recall": 0.3602, "cvss_f3": 0.3626, "cvss_f3_score": 36.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-207" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 20, "fp": 18, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5263, "recall": 0.7143, "f1": 0.6061, "f2": 0.6667, "f2_score": 66.7, "f3": 0.6897, "f3_score": 69.0, "tpr": 0.7143, "fpr": 0.8182, "youden_j": -0.1039, "cvss_coverage": 1.0, "cvss_tp_weight": 129.4, "cvss_fp_weight": 88.5, "cvss_fn_weight": 45.6, "cvss_precision": 0.5939, "cvss_recall": 0.7394, "cvss_f3": 0.7217, "cvss_f3_score": 72.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 14, "fp": 15, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4858, "recall": 0.5, "f1": 0.4912, "f2": 0.4961, "f2_score": 49.6, "f3": 0.4979, "f3_score": 49.8, "tpr": 0.5, "fpr": 0.7859, "youden_j": -0.2859, "cvss_coverage": 1.0, "cvss_tp_weight": 94.7, "cvss_fp_weight": 67.1, "cvss_fn_weight": 80.3, "cvss_precision": 0.5894, "cvss_recall": 0.5411, "cvss_f3": 0.5451, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 6, "fp": 4, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.2143, "f1": 0.3158, "f2": 0.2459, "f2_score": 24.6, "f3": 0.229, "f3_score": 22.9, "tpr": 0.2143, "fpr": 0.5, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 45.5, "cvss_fp_weight": 21.9, "cvss_fn_weight": 129.5, "cvss_precision": 0.6753, "cvss_recall": 0.26, "cvss_f3": 0.277, "cvss_f3_score": 27.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 22, "fp": 25, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4681, "recall": 0.7857, "f1": 0.5867, "f2": 0.6918, "f2_score": 69.2, "f3": 0.7358, "f3_score": 73.6, "tpr": 0.7857, "fpr": 0.8621, "youden_j": -0.0764, "cvss_coverage": 1.0, "cvss_tp_weight": 142.1, "cvss_fp_weight": 111.9, "cvss_fn_weight": 32.9, "cvss_precision": 0.5595, "cvss_recall": 0.812, "cvss_f3": 0.7769, "cvss_f3_score": 77.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 2, "recall": 0.8462 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/views.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 12, "fp": 10, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.4286, "f1": 0.48, "f2": 0.4478, "f2_score": 44.8, "f3": 0.438, "f3_score": 43.8, "tpr": 0.4286, "fpr": 0.7143, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 84.8, "cvss_fp_weight": 39.8, "cvss_fn_weight": 90.2, "cvss_precision": 0.6807, "cvss_recall": 0.4846, "cvss_f3": 0.4989, "cvss_f3_score": 49.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 12, "fp": 18, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.4286, "f1": 0.4138, "f2": 0.4225, "f2_score": 42.3, "f3": 0.4255, "f3_score": 42.6, "tpr": 0.4286, "fpr": 0.8182, "youden_j": -0.3896, "cvss_coverage": 1.0, "cvss_tp_weight": 79.4, "cvss_fp_weight": 93.5, "cvss_fn_weight": 95.6, "cvss_precision": 0.4593, "cvss_recall": 0.4537, "cvss_f3": 0.4543, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-266" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/discussion_detail.html", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 13, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6829, "recall": 1.0, "f1": 0.8116, "f2": 0.915, "f2_score": 91.5, "f3": 0.9556, "f3_score": 95.6, "tpr": 1.0, "fpr": 0.7647, "youden_j": 0.2353, "cvss_coverage": 1.0, "cvss_tp_weight": 175.0, "cvss_fp_weight": 71.1, "cvss_fn_weight": 0.0, "cvss_precision": 0.7111, "cvss_recall": 1.0, "cvss_f3": 0.961, "cvss_f3_score": 96.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-095", "file": "lms/course_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-344", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-651", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-742", "file": "lms/course_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7087, "recall": 0.4048, "f1": 0.5143, "f2": 0.4423, "f2_score": 44.2, "f3": 0.4227, "f3_score": 42.3, "tpr": 0.4048, "fpr": 0.5371, "youden_j": -0.1323, "cvss_coverage": 1.0, "cvss_tp_weight": 72.6, "cvss_fp_weight": 23.9, "cvss_fn_weight": 102.4, "cvss_precision": 0.753, "cvss_recall": 0.4149, "cvss_f3": 0.4343, "cvss_f3_score": 43.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 9, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5838, "recall": 0.4405, "f1": 0.4983, "f2": 0.4613, "f2_score": 46.1, "f3": 0.4506, "f3_score": 45.1, "tpr": 0.4405, "fpr": 0.6782, "youden_j": -0.2377, "cvss_coverage": 1.0, "cvss_tp_weight": 83.9, "cvss_fp_weight": 39.4, "cvss_fn_weight": 91.1, "cvss_precision": 0.7011, "cvss_recall": 0.4796, "cvss_f3": 0.494, "cvss_f3_score": 49.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 13, "fp": 17, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.437, "recall": 0.4524, "f1": 0.44, "f2": 0.4461, "f2_score": 44.6, "f3": 0.449, "f3_score": 44.9, "tpr": 0.4524, "fpr": 0.7989, "youden_j": -0.3465, "cvss_coverage": 1.0, "cvss_tp_weight": 86.1, "cvss_fp_weight": 68.1, "cvss_fn_weight": 88.9, "cvss_precision": 0.5611, "cvss_recall": 0.492, "cvss_f3": 0.4974, "cvss_f3_score": 49.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 16, "fp": 14, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.5714, "f1": 0.5517, "f2": 0.5634, "f2_score": 56.3, "f3": 0.5674, "f3_score": 56.7, "tpr": 0.5714, "fpr": 0.7778, "youden_j": -0.2063, "cvss_coverage": 1.0, "cvss_tp_weight": 104.9, "cvss_fp_weight": 51.7, "cvss_fn_weight": 70.1, "cvss_precision": 0.6698, "cvss_recall": 0.5994, "cvss_f3": 0.6058, "cvss_f3_score": 60.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-348" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 4, "fp": 8, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.1429, "f1": 0.2, "f2": 0.1613, "f2_score": 16.1, "f3": 0.1515, "f3_score": 15.2, "tpr": 0.1429, "fpr": 0.6667, "youden_j": -0.5238, "cvss_coverage": 1.0, "cvss_tp_weight": 27.1, "cvss_fp_weight": 42.0, "cvss_fn_weight": 147.9, "cvss_precision": 0.3922, "cvss_recall": 0.1549, "cvss_f3": 0.1648, "cvss_f3_score": 16.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-163", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-185", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-683", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-701", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-735", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 23, "fp": 59, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2805, "recall": 0.8214, "f1": 0.4182, "f2": 0.5928, "f2_score": 59.3, "f3": 0.6886, "f3_score": 68.9, "tpr": 0.8214, "fpr": 0.9365, "youden_j": -0.1151, "cvss_coverage": 1.0, "cvss_tp_weight": 149.8, "cvss_fp_weight": 380.0, "cvss_fn_weight": 25.2, "cvss_precision": 0.2827, "cvss_recall": 0.856, "cvss_f3": 0.7117, "cvss_f3_score": 71.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-095", "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/api_keys.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/webhooks.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-829" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 33, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3774, "recall": 0.7143, "f1": 0.4938, "f2": 0.6061, "f2_score": 60.6, "f3": 0.6557, "f3_score": 65.6, "tpr": 0.7143, "fpr": 0.8919, "youden_j": -0.1776, "cvss_coverage": 1.0, "cvss_tp_weight": 128.6, "cvss_fp_weight": 228.5, "cvss_fn_weight": 46.4, "cvss_precision": 0.3601, "cvss_recall": 0.7349, "cvss_f3": 0.6656, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-095", "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1393" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.0357, "f1": 0.069, "f2": 0.0442, "f2_score": 4.4, "f3": 0.0395, "f3_score": 4.0, "tpr": 0.0357, "fpr": 0.0, "youden_j": 0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 166.2, "cvss_precision": 1.0, "cvss_recall": 0.0503, "cvss_f3": 0.0556, "cvss_f3_score": 5.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-163", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-683", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-701", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-735", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 21, "fp": 59, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2625, "recall": 0.75, "f1": 0.3889, "f2": 0.5469, "f2_score": 54.7, "f3": 0.6325, "f3_score": 63.3, "tpr": 0.75, "fpr": 0.9365, "youden_j": -0.1865, "cvss_coverage": 1.0, "cvss_tp_weight": 131.3, "cvss_fp_weight": 440.5, "cvss_fn_weight": 43.7, "cvss_precision": 0.2296, "cvss_recall": 0.7503, "cvss_f3": 0.6116, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/api_keys.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/api_keys.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/student_dashboard.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/webhooks.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/webhooks.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 22, "fp": 16, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.7857, "f1": 0.6667, "f2": 0.7333, "f2_score": 73.3, "f3": 0.7586, "f3_score": 75.9, "tpr": 0.7857, "fpr": 0.8, "youden_j": -0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 141.3, "cvss_fp_weight": 118.0, "cvss_fn_weight": 33.7, "cvss_precision": 0.5449, "cvss_recall": 0.8074, "cvss_f3": 0.7703, "cvss_f3_score": 77.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8235 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/student_dashboard.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-344", "file": "lms/course_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-651", "file": "lms/course_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-742", "file": "lms/course_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": "lms/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/urls.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 11, "fp": 19, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3667, "recall": 0.3929, "f1": 0.3793, "f2": 0.3873, "f2_score": 38.7, "f3": 0.3901, "f3_score": 39.0, "tpr": 0.3929, "fpr": 0.8261, "youden_j": -0.4332, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 115.5, "cvss_fn_weight": 103.2, "cvss_precision": 0.3833, "cvss_recall": 0.4103, "cvss_f3": 0.4074, "cvss_f3_score": 40.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-683", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-701", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-735", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 75, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2268, "recall": 0.7857, "f1": 0.352, "f2": 0.5263, "f2_score": 52.6, "f3": 0.6304, "f3_score": 63.0, "tpr": 0.7857, "fpr": 0.9494, "youden_j": -0.1637, "cvss_coverage": 1.0, "cvss_tp_weight": 140.4, "cvss_fp_weight": 530.0, "cvss_fn_weight": 34.6, "cvss_precision": 0.2094, "cvss_recall": 0.8023, "cvss_f3": 0.6253, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "core/forms.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/api_keys.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/api_keys.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/student_dashboard.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/webhooks.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/templates/core/webhooks.html", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/urls.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": "core/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-096", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-691", "file": "lms/course_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 9, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7207, "recall": 0.3333, "f1": 0.4555, "f2": 0.3733, "f2_score": 37.3, "f3": 0.3522, "f3_score": 35.2, "tpr": 0.3333, "fpr": 0.4947, "youden_j": -0.1614, "cvss_coverage": 1.0, "cvss_tp_weight": 64.5, "cvss_fp_weight": 20.0, "cvss_fn_weight": 110.5, "cvss_precision": 0.7639, "cvss_recall": 0.3684, "cvss_f3": 0.3884, "cvss_f3_score": 38.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 3, "fp": 1, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 13, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 0.4643, "f1": 0.5417, "f2": 0.4924, "f2_score": 49.2, "f3": 0.4779, "f3_score": 47.8, "tpr": 0.4643, "fpr": 0.6364, "youden_j": -0.1721, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 38.3, "cvss_fn_weight": 88.4, "cvss_precision": 0.6935, "cvss_recall": 0.4949, "cvss_f3": 0.5094, "cvss_f3_score": 50.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-208", "file": "lms/course_operations.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 13, "fp": 9, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5909, "recall": 0.4643, "f1": 0.52, "f2": 0.4851, "f2_score": 48.5, "f3": 0.4745, "f3_score": 47.4, "tpr": 0.4643, "fpr": 0.75, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 86.6, "cvss_fp_weight": 29.3, "cvss_fn_weight": 88.4, "cvss_precision": 0.7469, "cvss_recall": 0.4949, "cvss_f3": 0.5121, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 }, "medium": { "tp": 6, "fp": 1, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-711", "file": "lms/course_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-163", "file": "lms/course_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-671", "file": "lms/course_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-250", "file": "lms/course_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": ".env.example", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-661", "file": "lms/course_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-094", "file": "lms/course_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": ".env.example", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-780" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": "lms/course_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 47, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1132, "recall": 0.2143, "f1": 0.1481, "f2": 0.1818, "f2_score": 18.2, "f3": 0.1967, "f3_score": 19.7, "tpr": 0.2143, "fpr": 0.9216, "youden_j": -0.7073, "cvss_coverage": 1.0, "cvss_tp_weight": 43.7, "cvss_fp_weight": 169.0, "cvss_fn_weight": 131.3, "cvss_precision": 0.2055, "cvss_recall": 0.2497, "cvss_f3": 0.2444, "cvss_f3_score": 24.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-735", "file": "lms/course_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-300", "file": "lms/course_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-683", "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-163", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 15, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7895, "youden_j": -0.7895, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 82.0, "cvss_fn_weight": 175.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/management/commands/seed.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/templates/core/assignment_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/templates/core/grade_submission.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/core/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-education-lms-django/lms/course_operations.py", "cwe": "CWE-939" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-163", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-185", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-683", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-701", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-727", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-735", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 3, "fp": 101, "fn": 25, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0288, "recall": 0.1071, "f1": 0.0455, "f2": 0.0694, "f2_score": 6.9, "f3": 0.0843, "f3_score": 8.4, "tpr": 0.1071, "fpr": 0.9619, "youden_j": -0.8548, "cvss_coverage": 1.0, "cvss_tp_weight": 23.0, "cvss_fp_weight": 556.4, "cvss_fn_weight": 152.0, "cvss_precision": 0.0397, "cvss_recall": 0.1314, "cvss_f3": 0.1068, "cvss_f3_score": 10.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-185", "file": "lms/course_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-701", "file": "lms/course_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-727", "file": "lms/course_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/course_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "lms/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-094", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-095", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-096", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-163", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-208", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-250", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-300", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-344", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-651", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-661", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-671", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-683", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-691", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-711", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-735", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-742", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-fp-004", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-003", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-004", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-005", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-006", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-007", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-education-lms-django-enrich-009", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-fintech-lending-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 22, "fp": 24, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4783, "recall": 0.6667, "f1": 0.557, "f2": 0.618, "f2_score": 61.8, "f3": 0.6414, "f3_score": 64.1, "tpr": 0.6667, "fpr": 0.8889, "youden_j": -0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 139.0, "cvss_fp_weight": 121.7, "cvss_fn_weight": 64.0, "cvss_precision": 0.5332, "cvss_recall": 0.6847, "cvss_f3": 0.6658, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 1, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-652", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-548" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 18, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8571, "recall": 0.5455, "f1": 0.6667, "f2": 0.5882, "f2_score": 58.8, "f3": 0.566, "f3_score": 56.6, "tpr": 0.5455, "fpr": 0.4286, "youden_j": 0.1169, "cvss_coverage": 1.0, "cvss_tp_weight": 116.9, "cvss_fp_weight": 11.5, "cvss_fn_weight": 86.1, "cvss_precision": 0.9106, "cvss_recall": 0.5759, "cvss_f3": 0.5978, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 18, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.5455, "f1": 0.6545, "f2": 0.5844, "f2_score": 58.4, "f3": 0.5643, "f3_score": 56.4, "tpr": 0.5455, "fpr": 0.5, "youden_j": 0.0455, "cvss_coverage": 1.0, "cvss_tp_weight": 116.9, "cvss_fp_weight": 21.9, "cvss_fn_weight": 86.1, "cvss_precision": 0.8419, "cvss_recall": 0.5759, "cvss_f3": 0.5947, "cvss_f3_score": 59.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 17, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.5152, "f1": 0.6415, "f2": 0.5592, "f2_score": 55.9, "f3": 0.5363, "f3_score": 53.6, "tpr": 0.5152, "fpr": 0.4286, "youden_j": 0.0866, "cvss_coverage": 1.0, "cvss_tp_weight": 111.5, "cvss_fp_weight": 11.5, "cvss_fn_weight": 91.5, "cvss_precision": 0.9067, "cvss_recall": 0.5493, "cvss_f3": 0.5718, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 12, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.6061, "f1": 0.6154, "f2": 0.6098, "f2_score": 61.0, "f3": 0.6079, "f3_score": 60.8, "tpr": 0.6061, "fpr": 0.75, "youden_j": -0.1439, "cvss_coverage": 1.0, "cvss_tp_weight": 126.6, "cvss_fp_weight": 50.9, "cvss_fn_weight": 76.4, "cvss_precision": 0.7133, "cvss_recall": 0.6236, "cvss_f3": 0.6316, "cvss_f3_score": 63.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-097", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-140", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 13, "fp": 0, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.3939, "f1": 0.5652, "f2": 0.4483, "f2_score": 44.8, "f3": 0.4194, "f3_score": 41.9, "tpr": 0.3939, "fpr": 0.0, "youden_j": 0.3939, "cvss_coverage": 1.0, "cvss_tp_weight": 83.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 119.9, "cvss_precision": 1.0, "cvss_recall": 0.4094, "cvss_f3": 0.4351, "cvss_f3_score": 43.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 14, "fp": 0, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.4242, "f1": 0.5957, "f2": 0.4795, "f2_score": 47.9, "f3": 0.4502, "f3_score": 45.0, "tpr": 0.4242, "fpr": 0.0, "youden_j": 0.4242, "cvss_coverage": 1.0, "cvss_tp_weight": 90.6, "cvss_fp_weight": 0.0, "cvss_fn_weight": 112.4, "cvss_precision": 1.0, "cvss_recall": 0.4463, "cvss_f3": 0.4725, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 10, "recall": 0.4118 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 4, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7961, "recall": 0.4343, "f1": 0.5613, "f2": 0.4774, "f2_score": 47.7, "f3": 0.4549, "f3_score": 45.5, "tpr": 0.4343, "fpr": 0.4762, "youden_j": -0.0419, "cvss_coverage": 1.0, "cvss_tp_weight": 93.7, "cvss_fp_weight": 18.5, "cvss_fn_weight": 109.3, "cvss_precision": 0.836, "cvss_recall": 0.4617, "cvss_f3": 0.4831, "cvss_f3_score": 48.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 19, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7687, "recall": 0.5657, "f1": 0.6515, "f2": 0.5971, "f2_score": 59.7, "f3": 0.581, "f3_score": 58.1, "tpr": 0.5657, "fpr": 0.5788, "youden_j": -0.0131, "cvss_coverage": 1.0, "cvss_tp_weight": 123.0, "cvss_fp_weight": 22.8, "cvss_fn_weight": 80.0, "cvss_precision": 0.8444, "cvss_recall": 0.6059, "cvss_f3": 0.6235, "cvss_f3_score": 62.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 18, "fp": 15, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5832, "recall": 0.5354, "f1": 0.5493, "f2": 0.5388, "f2_score": 53.9, "f3": 0.5367, "f3_score": 53.6, "tpr": 0.5354, "fpr": 0.7318, "youden_j": -0.1964, "cvss_coverage": 1.0, "cvss_tp_weight": 114.0, "cvss_fp_weight": 70.5, "cvss_fn_weight": 89.0, "cvss_precision": 0.6557, "cvss_recall": 0.5616, "cvss_f3": 0.567, "cvss_f3_score": 56.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 16, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5676, "recall": 0.6364, "f1": 0.6, "f2": 0.6213, "f2_score": 62.1, "f3": 0.6287, "f3_score": 62.9, "tpr": 0.6364, "fpr": 0.8, "youden_j": -0.1636, "cvss_coverage": 1.0, "cvss_tp_weight": 132.3, "cvss_fp_weight": 72.8, "cvss_fn_weight": 70.7, "cvss_precision": 0.645, "cvss_recall": 0.6517, "cvss_f3": 0.651, "cvss_f3_score": 65.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-538" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7138, "recall": 0.4747, "f1": 0.5696, "f2": 0.5085, "f2_score": 50.8, "f3": 0.4911, "f3_score": 49.1, "tpr": 0.4747, "fpr": 0.6095, "youden_j": -0.1347, "cvss_coverage": 1.0, "cvss_tp_weight": 104.3, "cvss_fp_weight": 28.1, "cvss_fn_weight": 98.7, "cvss_precision": 0.789, "cvss_recall": 0.5136, "cvss_f3": 0.5321, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/routers/notes.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 16, "fp": 6, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.4848, "f1": 0.5818, "f2": 0.5195, "f2_score": 51.9, "f3": 0.5016, "f3_score": 50.2, "tpr": 0.4848, "fpr": 0.6, "youden_j": -0.1152, "cvss_coverage": 1.0, "cvss_tp_weight": 106.1, "cvss_fp_weight": 27.9, "cvss_fn_weight": 96.9, "cvss_precision": 0.7916, "cvss_recall": 0.5227, "cvss_f3": 0.541, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 13, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5938, "recall": 0.5758, "f1": 0.5846, "f2": 0.5793, "f2_score": 57.9, "f3": 0.5775, "f3_score": 57.8, "tpr": 0.5758, "fpr": 0.7647, "youden_j": -0.1889, "cvss_coverage": 1.0, "cvss_tp_weight": 121.5, "cvss_fp_weight": 61.4, "cvss_fn_weight": 81.5, "cvss_precision": 0.6645, "cvss_recall": 0.5985, "cvss_f3": 0.6045, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-097", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 16, "fp": 1, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9412, "recall": 0.4848, "f1": 0.64, "f2": 0.5369, "f2_score": 53.7, "f3": 0.5096, "f3_score": 51.0, "tpr": 0.4848, "fpr": 0.2, "youden_j": 0.2848, "cvss_coverage": 1.0, "cvss_tp_weight": 107.1, "cvss_fp_weight": 5.5, "cvss_fn_weight": 95.9, "cvss_precision": 0.9513, "cvss_recall": 0.5276, "cvss_f3": 0.5522, "cvss_f3_score": 55.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 7, "recall": 0.5882 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 14, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.4848, "f1": 0.5079, "f2": 0.4938, "f2_score": 49.4, "f3": 0.4893, "f3_score": 48.9, "tpr": 0.4848, "fpr": 0.7778, "youden_j": -0.2929, "cvss_coverage": 1.0, "cvss_tp_weight": 103.6, "cvss_fp_weight": 71.8, "cvss_fn_weight": 99.4, "cvss_precision": 0.5906, "cvss_recall": 0.5103, "cvss_f3": 0.5174, "cvss_f3_score": 51.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 25, "fp": 12, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6757, "recall": 0.7576, "f1": 0.7143, "f2": 0.7396, "f2_score": 74.0, "f3": 0.7485, "f3_score": 74.9, "tpr": 0.7576, "fpr": 0.75, "youden_j": 0.0076, "cvss_coverage": 1.0, "cvss_tp_weight": 158.3, "cvss_fp_weight": 60.9, "cvss_fn_weight": 44.7, "cvss_precision": 0.7223, "cvss_recall": 0.7798, "cvss_f3": 0.7736, "cvss_f3_score": 77.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-097", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/routers/notes.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 15, "fp": 7, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6865, "recall": 0.4545, "f1": 0.5442, "f2": 0.4862, "f2_score": 48.6, "f3": 0.4698, "f3_score": 47.0, "tpr": 0.4545, "fpr": 0.6571, "youden_j": -0.2026, "cvss_coverage": 1.0, "cvss_tp_weight": 98.5, "cvss_fp_weight": 22.0, "cvss_fn_weight": 104.5, "cvss_precision": 0.8186, "cvss_recall": 0.4854, "cvss_f3": 0.5059, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 }, "medium": { "tp": 5, "fp": 1, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7703, "recall": 0.4545, "f1": 0.5704, "f2": 0.4946, "f2_score": 49.4, "f3": 0.4737, "f3_score": 47.4, "tpr": 0.4545, "fpr": 0.5333, "youden_j": -0.0788, "cvss_coverage": 1.0, "cvss_tp_weight": 98.1, "cvss_fp_weight": 18.9, "cvss_fn_weight": 104.9, "cvss_precision": 0.8432, "cvss_recall": 0.4831, "cvss_f3": 0.5045, "cvss_f3_score": 50.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.746, "recall": 0.4747, "f1": 0.5803, "f2": 0.512, "f2_score": 51.2, "f3": 0.4926, "f3_score": 49.3, "tpr": 0.4747, "fpr": 0.5704, "youden_j": -0.0956, "cvss_coverage": 1.0, "cvss_tp_weight": 104.0, "cvss_fp_weight": 22.6, "cvss_fn_weight": 99.0, "cvss_precision": 0.8213, "cvss_recall": 0.5123, "cvss_f3": 0.5323, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/api.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/api.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.6364, "f1": 0.6885, "f2": 0.6562, "f2_score": 65.6, "f3": 0.6462, "f3_score": 64.6, "tpr": 0.6364, "fpr": 0.6364, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 132.3, "cvss_fp_weight": 18.5, "cvss_fn_weight": 70.7, "cvss_precision": 0.8776, "cvss_recall": 0.6517, "cvss_f3": 0.6689, "cvss_f3_score": 66.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-140", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 17, "fp": 11, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.5152, "f1": 0.5574, "f2": 0.5312, "f2_score": 53.1, "f3": 0.5231, "f3_score": 52.3, "tpr": 0.5152, "fpr": 0.7333, "youden_j": -0.2182, "cvss_coverage": 1.0, "cvss_tp_weight": 108.1, "cvss_fp_weight": 57.5, "cvss_fn_weight": 94.9, "cvss_precision": 0.6528, "cvss_recall": 0.5325, "cvss_f3": 0.5425, "cvss_f3_score": 54.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 11, "fp": 0, "fn": 6, "recall": 0.6471 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-330", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-731", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 28, "fp": 60, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3182, "recall": 0.8485, "f1": 0.4628, "f2": 0.6364, "f2_score": 63.6, "f3": 0.7273, "f3_score": 72.7, "tpr": 0.8485, "fpr": 0.9524, "youden_j": -0.1039, "cvss_coverage": 1.0, "cvss_tp_weight": 176.6, "cvss_fp_weight": 389.5, "cvss_fn_weight": 26.4, "cvss_precision": 0.312, "cvss_recall": 0.87, "cvss_f3": 0.738, "cvss_f3_score": 73.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 1, "fn": 1, "precision": 0.75, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 1, "fn": 3, "recall": 0.8235 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/routers/notes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/api.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/api.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 28, "fp": 27, "fn": 5, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5091, "recall": 0.8485, "f1": 0.6364, "f2": 0.7487, "f2_score": 74.9, "f3": 0.7955, "f3_score": 79.5, "tpr": 0.8485, "fpr": 0.9, "youden_j": -0.0515, "cvss_coverage": 1.0, "cvss_tp_weight": 174.9, "cvss_fp_weight": 186.0, "cvss_fn_weight": 28.1, "cvss_precision": 0.4846, "cvss_recall": 0.8616, "cvss_f3": 0.7994, "cvss_f3_score": 79.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 1, "fn": 2, "precision": 0.6667, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 1, "fn": 4, "recall": 0.7647 }, "medium": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/user.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/borrowers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/api.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 6, "fp": 6, "fn": 27, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.1818, "f1": 0.2667, "f2": 0.2083, "f2_score": 20.8, "f3": 0.1942, "f3_score": 19.4, "tpr": 0.1818, "fpr": 0.6667, "youden_j": -0.4848, "cvss_coverage": 1.0, "cvss_tp_weight": 41.7, "cvss_fp_weight": 40.5, "cvss_fn_weight": 161.3, "cvss_precision": 0.5073, "cvss_recall": 0.2054, "cvss_f3": 0.2184, "cvss_f3_score": 21.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 1, "fn": 3, "precision": 0.5, "recall": 0.25 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 1, "fn": 12, "recall": 0.2941 }, "medium": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": "backend/app/routers/borrowers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/routers/notes.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notes.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-098", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-099", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-166", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-702", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-731", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-740", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 27, "fp": 54, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.8182, "f1": 0.4737, "f2": 0.6338, "f2_score": 63.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.8182, "fpr": 0.9474, "youden_j": -0.1292, "cvss_coverage": 1.0, "cvss_tp_weight": 164.0, "cvss_fp_weight": 396.0, "cvss_fn_weight": 39.0, "cvss_precision": 0.2929, "cvss_recall": 0.8079, "cvss_f3": 0.6871, "cvss_f3_score": 68.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 }, "medium": { "tp": 13, "fp": 1, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-140", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-652", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "start.sh", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "start.sh", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 31, "fp": 10, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7561, "recall": 0.9394, "f1": 0.8378, "f2": 0.896, "f2_score": 89.6, "f3": 0.9172, "f3_score": 91.7, "tpr": 0.9394, "fpr": 0.7692, "youden_j": 0.1702, "cvss_coverage": 1.0, "cvss_tp_weight": 192.2, "cvss_fp_weight": 75.0, "cvss_fn_weight": 10.8, "cvss_precision": 0.7193, "cvss_recall": 0.9468, "cvss_f3": 0.9178, "cvss_f3_score": 91.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 2, "recall": 0.8824 }, "medium": { "tp": 14, "fp": 1, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": "backend/app/core/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": "backend/app/routers/applications.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-140", "file": "backend/app/loan_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-652", "file": "backend/app/loan_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/models/user.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminUsers.jsx", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 17, "fp": 19, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4722, "recall": 0.5152, "f1": 0.4928, "f2": 0.506, "f2_score": 50.6, "f3": 0.5105, "f3_score": 51.1, "tpr": 0.5152, "fpr": 0.8261, "youden_j": -0.3109, "cvss_coverage": 1.0, "cvss_tp_weight": 111.4, "cvss_fp_weight": 127.5, "cvss_fn_weight": 91.6, "cvss_precision": 0.4663, "cvss_recall": 0.5488, "cvss_f3": 0.5392, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 9, "recall": 0.4706 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": "backend/app/routers/notes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-731", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 27, "fp": 74, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2673, "recall": 0.8182, "f1": 0.403, "f2": 0.5794, "f2_score": 57.9, "f3": 0.6784, "f3_score": 67.8, "tpr": 0.8182, "fpr": 0.961, "youden_j": -0.1429, "cvss_coverage": 1.0, "cvss_tp_weight": 164.0, "cvss_fp_weight": 535.5, "cvss_fn_weight": 39.0, "cvss_precision": 0.2345, "cvss_recall": 0.8079, "cvss_f3": 0.6491, "cvss_f3_score": 64.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 0, "precision": 0.5, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 5, "recall": 0.7059 }, "medium": { "tp": 13, "fp": 1, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-140", "file": "backend/app/loan_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-209", "file": "backend/app/loan_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-652", "file": "backend/app/loan_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-662", "file": "backend/app/loan_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-692", "file": "backend/app/loan_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-548" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/api.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/borrower.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/user.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": "backend/app/routers/applications.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-362" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/decisions.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/user.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/user.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "start.sh", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "start.sh", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 203.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-098", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-099", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-166", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-266", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-330", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-702", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-731", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-740", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 15, "fp": 7, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6818, "recall": 0.4545, "f1": 0.5455, "f2": 0.487, "f2_score": 48.7, "f3": 0.4702, "f3_score": 47.0, "tpr": 0.4545, "fpr": 0.6364, "youden_j": -0.1818, "cvss_coverage": 1.0, "cvss_tp_weight": 99.6, "cvss_fp_weight": 18.5, "cvss_fn_weight": 103.4, "cvss_precision": 0.8436, "cvss_recall": 0.4906, "cvss_f3": 0.5121, "cvss_f3_score": 51.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 8, "recall": 0.5294 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-098", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-720", "file": "backend/app/loan_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-712", "file": "backend/app/loan_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-672", "file": "backend/app/loan_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-346" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 11, "fp": 20, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3548, "recall": 0.3333, "f1": 0.3438, "f2": 0.3374, "f2_score": 33.7, "f3": 0.3354, "f3_score": 33.5, "tpr": 0.3333, "fpr": 0.8333, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 71.8, "cvss_fp_weight": 111.5, "cvss_fn_weight": 131.2, "cvss_precision": 0.3917, "cvss_recall": 0.3537, "cvss_f3": 0.3572, "cvss_f3_score": 35.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 13, "recall": 0.2353 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-680", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-330", "file": "backend/app/loan_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-740", "file": "backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/applications.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-208" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-098", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-166", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 8, "fn": 33, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6667, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 38.9, "cvss_fn_weight": 203.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 17, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/loan_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-fintech-lending-fastapi/docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-098", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-099", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-166", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-266", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-301", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-330", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-702", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-731", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-740", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 21, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.2121, "f1": 0.2295, "f2": 0.2187, "f2_score": 21.9, "f3": 0.2154, "f3_score": 21.5, "tpr": 0.2121, "fpr": 0.84, "youden_j": -0.6279, "cvss_coverage": 1.0, "cvss_tp_weight": 45.8, "cvss_fp_weight": 119.2, "cvss_fn_weight": 157.2, "cvss_precision": 0.2775, "cvss_recall": 0.2256, "cvss_f3": 0.2299, "cvss_f3_score": 23.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 3, "fp": 0, "fn": 14, "recall": 0.1765 }, "medium": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-099", "file": "backend/app/loan_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-166", "file": "backend/app/loan_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-266", "file": "backend/app/loan_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-301", "file": "backend/app/loan_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-702", "file": "backend/app/loan_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-731", "file": "backend/app/loan_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/loan_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-097", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-098", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-140", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-209", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-330", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-652", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-662", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-672", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-680", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-692", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-712", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-720", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-740", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-fp-004", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-007", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-009", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-010", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-011", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-012", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-fintech-lending-fastapi-enrich-014", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-healthcare-clinic-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 9, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.7, "f1": 0.7, "f2": 0.7, "f2_score": 70.0, "f3": 0.7, "f3_score": 70.0, "tpr": 0.7, "fpr": 0.6923, "youden_j": 0.0077, "cvss_coverage": 1.0, "cvss_tp_weight": 126.0, "cvss_fp_weight": 37.9, "cvss_fn_weight": 53.1, "cvss_precision": 0.7689, "cvss_recall": 0.7035, "cvss_f3": 0.7095, "cvss_f3_score": 71.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 12, "fp": 0, "fn": 6, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-743", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 15, "fp": 11, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5769, "recall": 0.5, "f1": 0.5357, "f2": 0.5137, "f2_score": 51.4, "f3": 0.5068, "f3_score": 50.7, "tpr": 0.5, "fpr": 0.7333, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 93.2, "cvss_fp_weight": 48.4, "cvss_fn_weight": 85.9, "cvss_precision": 0.6582, "cvss_recall": 0.5204, "cvss_f3": 0.5315, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.4, "f1": 0.5106, "f2": 0.438, "f2_score": 43.8, "f3": 0.4181, "f3_score": 41.8, "tpr": 0.4, "fpr": 0.5556, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 68.9, "cvss_fp_weight": 16.8, "cvss_fn_weight": 110.2, "cvss_precision": 0.8039, "cvss_recall": 0.3847, "cvss_f3": 0.4059, "cvss_f3_score": 40.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 7, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5333, "f1": 0.6038, "f2": 0.5594, "f2_score": 55.9, "f3": 0.5461, "f3_score": 54.6, "tpr": 0.5333, "fpr": 0.6364, "youden_j": -0.103, "cvss_coverage": 1.0, "cvss_tp_weight": 99.7, "cvss_fp_weight": 17.8, "cvss_fn_weight": 79.4, "cvss_precision": 0.8485, "cvss_recall": 0.5567, "cvss_f3": 0.5765, "cvss_f3_score": 57.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 14, "fp": 7, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4667, "f1": 0.549, "f2": 0.4965, "f2_score": 49.6, "f3": 0.4811, "f3_score": 48.1, "tpr": 0.4667, "fpr": 0.6364, "youden_j": -0.1697, "cvss_coverage": 1.0, "cvss_tp_weight": 85.6, "cvss_fp_weight": 32.1, "cvss_fn_weight": 93.5, "cvss_precision": 0.7272, "cvss_recall": 0.4779, "cvss_f3": 0.4949, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 179.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-100", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-167", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-227", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-267", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-684", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 13, "fp": 3, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8131, "recall": 0.4222, "f1": 0.5554, "f2": 0.467, "f2_score": 46.7, "f3": 0.4434, "f3_score": 44.3, "tpr": 0.4222, "fpr": 0.4074, "youden_j": 0.0148, "cvss_coverage": 1.0, "cvss_tp_weight": 77.0, "cvss_fp_weight": 9.5, "cvss_fn_weight": 102.1, "cvss_precision": 0.8914, "cvss_recall": 0.4299, "cvss_f3": 0.4534, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 14, "fp": 8, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.628, "recall": 0.4667, "f1": 0.5352, "f2": 0.4918, "f2_score": 49.2, "f3": 0.4789, "f3_score": 47.9, "tpr": 0.4667, "fpr": 0.6737, "youden_j": -0.207, "cvss_coverage": 1.0, "cvss_tp_weight": 87.0, "cvss_fp_weight": 29.6, "cvss_fn_weight": 92.1, "cvss_precision": 0.7476, "cvss_recall": 0.486, "cvss_f3": 0.5035, "cvss_f3_score": 50.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/middleware.py", "cwe": "CWE-290" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 12, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5792, "recall": 0.5333, "f1": 0.5529, "f2": 0.5405, "f2_score": 54.1, "f3": 0.5368, "f3_score": 53.7, "tpr": 0.5333, "fpr": 0.7389, "youden_j": -0.2055, "cvss_coverage": 1.0, "cvss_tp_weight": 100.0, "cvss_fp_weight": 33.0, "cvss_fn_weight": 79.1, "cvss_precision": 0.7568, "cvss_recall": 0.5583, "cvss_f3": 0.5731, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/middleware.py", "cwe": "CWE-345" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 21, "fp": 21, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7, "f1": 0.5833, "f2": 0.6481, "f2_score": 64.8, "f3": 0.6731, "f3_score": 67.3, "tpr": 0.7, "fpr": 0.84, "youden_j": -0.14, "cvss_coverage": 1.0, "cvss_tp_weight": 129.0, "cvss_fp_weight": 77.2, "cvss_fn_weight": 50.1, "cvss_precision": 0.6255, "cvss_recall": 0.7203, "cvss_f3": 0.7095, "cvss_f3_score": 71.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 11, "fp": 0, "fn": 7, "recall": 0.6111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/middleware.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 11, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5901, "recall": 0.5222, "f1": 0.5518, "f2": 0.5332, "f2_score": 53.3, "f3": 0.5276, "f3_score": 52.8, "tpr": 0.5222, "fpr": 0.727, "youden_j": -0.2048, "cvss_coverage": 1.0, "cvss_tp_weight": 98.6, "cvss_fp_weight": 38.7, "cvss_fn_weight": 80.5, "cvss_precision": 0.7138, "cvss_recall": 0.5507, "cvss_f3": 0.5629, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 9, "fp": 2, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8182, "recall": 0.3, "f1": 0.439, "f2": 0.3435, "f2_score": 34.4, "f3": 0.3203, "f3_score": 32.0, "tpr": 0.3, "fpr": 0.3333, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 58.6, "cvss_fp_weight": 5.8, "cvss_fn_weight": 120.5, "cvss_precision": 0.9104, "cvss_recall": 0.3272, "cvss_f3": 0.3496, "cvss_f3_score": 35.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 4, "fp": 0, "fn": 14, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 30, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 179.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-345", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-653", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-743", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 5, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.4667, "f1": 0.5714, "f2": 0.5036, "f2_score": 50.4, "f3": 0.4844, "f3_score": 48.4, "tpr": 0.4667, "fpr": 0.5556, "youden_j": -0.0889, "cvss_coverage": 1.0, "cvss_tp_weight": 91.0, "cvss_fp_weight": 21.6, "cvss_fn_weight": 88.1, "cvss_precision": 0.8084, "cvss_recall": 0.5081, "cvss_f3": 0.5277, "cvss_f3_score": 52.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 15, "fp": 22, "fn": 15, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4054, "recall": 0.5, "f1": 0.4478, "f2": 0.4777, "f2_score": 47.8, "f3": 0.4886, "f3_score": 48.9, "tpr": 0.5, "fpr": 0.88, "youden_j": -0.38, "cvss_coverage": 1.0, "cvss_tp_weight": 93.8, "cvss_fp_weight": 96.8, "cvss_fn_weight": 85.3, "cvss_precision": 0.4921, "cvss_recall": 0.5237, "cvss_f3": 0.5204, "cvss_f3_score": 52.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/middleware.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 30, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 179.1, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-345", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-653", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-743", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 11, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6775, "recall": 0.3555, "f1": 0.4657, "f2": 0.3926, "f2_score": 39.3, "f3": 0.3732, "f3_score": 37.3, "tpr": 0.3555, "fpr": 0.5519, "youden_j": -0.1963, "cvss_coverage": 1.0, "cvss_tp_weight": 63.2, "cvss_fp_weight": 20.0, "cvss_fn_weight": 115.9, "cvss_precision": 0.7581, "cvss_recall": 0.3527, "cvss_f3": 0.3724, "cvss_f3_score": 37.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7059, "recall": 0.4, "f1": 0.5106, "f2": 0.438, "f2_score": 43.8, "f3": 0.4181, "f3_score": 41.8, "tpr": 0.4, "fpr": 0.5556, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 75.9, "cvss_fp_weight": 16.8, "cvss_fn_weight": 103.2, "cvss_precision": 0.8187, "cvss_recall": 0.4238, "cvss_f3": 0.4453, "cvss_f3_score": 44.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 6, "fp": 0, "fn": 12, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6171, "recall": 0.4111, "f1": 0.4921, "f2": 0.4399, "f2_score": 44.0, "f3": 0.425, "f3_score": 42.5, "tpr": 0.4111, "fpr": 0.655, "youden_j": -0.2439, "cvss_coverage": 1.0, "cvss_tp_weight": 77.7, "cvss_fp_weight": 21.3, "cvss_fn_weight": 101.4, "cvss_precision": 0.7967, "cvss_recall": 0.4336, "cvss_f3": 0.4535, "cvss_f3_score": 45.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3889 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "medium": { "tp": 8, "fp": 0, "fn": 10, "recall": 0.4444 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 15, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.6667, "f1": 0.6154, "f2": 0.6452, "f2_score": 64.5, "f3": 0.6557, "f3_score": 65.6, "tpr": 0.6667, "fpr": 0.7895, "youden_j": -0.1228, "cvss_coverage": 1.0, "cvss_tp_weight": 122.6, "cvss_fp_weight": 55.2, "cvss_fn_weight": 56.5, "cvss_precision": 0.6896, "cvss_recall": 0.6845, "cvss_f3": 0.685, "cvss_f3_score": 68.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 19, "fp": 15, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5588, "recall": 0.6333, "f1": 0.5938, "f2": 0.6169, "f2_score": 61.7, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6333, "fpr": 0.8333, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 114.0, "cvss_fp_weight": 74.5, "cvss_fn_weight": 65.1, "cvss_precision": 0.6048, "cvss_recall": 0.6365, "cvss_f3": 0.6332, "cvss_f3_score": 63.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 10, "fp": 0, "fn": 8, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 57, "fn": 9, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.2692, "recall": 0.7, "f1": 0.3889, "f2": 0.5303, "f2_score": 53.0, "f3": 0.6034, "f3_score": 60.3, "tpr": 0.7, "fpr": 0.9661, "youden_j": -0.2661, "cvss_coverage": 1.0, "cvss_tp_weight": 127.7, "cvss_fp_weight": 373.0, "cvss_fn_weight": 51.4, "cvss_precision": 0.255, "cvss_recall": 0.713, "cvss_f3": 0.6045, "cvss_f3_score": 60.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 1, "fn": 1, "precision": 0.6667, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 2, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 12, "fp": 0, "fn": 6, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-755" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-93" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-799" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 33, "fn": 10, "tn": 2, "ns": 0, "ns_gt": 0, "precision": 0.3774, "recall": 0.6667, "f1": 0.4819, "f2": 0.578, "f2_score": 57.8, "f3": 0.6192, "f3_score": 61.9, "tpr": 0.6667, "fpr": 0.9429, "youden_j": -0.2762, "cvss_coverage": 1.0, "cvss_tp_weight": 121.2, "cvss_fp_weight": 237.0, "cvss_fn_weight": 57.9, "cvss_precision": 0.3384, "cvss_recall": 0.6767, "cvss_f3": 0.6152, "cvss_f3_score": 61.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 1, "fn": 1, "precision": 0.6667, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 2, "fn": 3, "recall": 0.7273 }, "medium": { "tp": 11, "fp": 0, "fn": 7, "recall": 0.6111 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 4, "fp": 2, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.1333, "f1": 0.2222, "f2": 0.1587, "f2_score": 15.9, "f3": 0.1449, "f3_score": 14.5, "tpr": 0.1333, "fpr": 0.3333, "youden_j": -0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 24.1, "cvss_fp_weight": 16.0, "cvss_fn_weight": 155.0, "cvss_precision": 0.601, "cvss_recall": 0.1346, "cvss_f3": 0.1459, "cvss_f3_score": 14.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/urls.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-100", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-684", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 25, "fp": 57, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3049, "recall": 0.8333, "f1": 0.4464, "f2": 0.6188, "f2_score": 61.9, "f3": 0.7102, "f3_score": 71.0, "tpr": 0.8333, "fpr": 0.9344, "youden_j": -0.1011, "cvss_coverage": 1.0, "cvss_tp_weight": 151.5, "cvss_fp_weight": 363.5, "cvss_fn_weight": 27.6, "cvss_precision": 0.2942, "cvss_recall": 0.8459, "cvss_f3": 0.7123, "cvss_f3_score": 71.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/appointment_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/document_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/message_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/patient_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/patient_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/prescription_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/prescription_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/user_management.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/user_management.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/webhook_settings.html", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 8, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.9333, "f1": 0.8485, "f2": 0.8974, "f2_score": 89.7, "f3": 0.915, "f3_score": 91.5, "tpr": 0.9333, "fpr": 0.6667, "youden_j": 0.2667, "cvss_coverage": 1.0, "cvss_tp_weight": 166.1, "cvss_fp_weight": 61.5, "cvss_fn_weight": 13.0, "cvss_precision": 0.7298, "cvss_recall": 0.9274, "cvss_f3": 0.903, "cvss_f3_score": 90.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "medium": { "tp": 18, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-345", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-653", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-743", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": "clinic_portal/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-601" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 16, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 0.3, "f1": 0.3273, "f2": 0.3103, "f2_score": 31.0, "f3": 0.3051, "f3_score": 30.5, "tpr": 0.3, "fpr": 0.8, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 48.1, "cvss_fp_weight": 106.5, "cvss_fn_weight": 131.0, "cvss_precision": 0.3111, "cvss_recall": 0.2686, "cvss_f3": 0.2723, "cvss_f3_score": 27.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "medium": { "tp": 7, "fp": 0, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/forms.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/models.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-267", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-684", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 78, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2427, "recall": 0.8333, "f1": 0.3759, "f2": 0.5605, "f2_score": 56.1, "f3": 0.6702, "f3_score": 67.0, "tpr": 0.8333, "fpr": 0.9512, "youden_j": -0.1179, "cvss_coverage": 1.0, "cvss_tp_weight": 151.5, "cvss_fp_weight": 494.0, "cvss_fn_weight": 27.6, "cvss_precision": 0.2347, "cvss_recall": 0.8459, "cvss_f3": 0.6711, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "medium": { "tp": 14, "fp": 0, "fn": 4, "recall": 0.7778 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-141", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-693", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": "clinic_portal/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": "portal/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/appointment_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/document_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/message_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/patient_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/patient_list.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/prescription_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/prescription_list.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/user_management.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/user_management.html", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/portal/webhook_settings.html", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 8, "fp": 1, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.2667, "f1": 0.4103, "f2": 0.3101, "f2_score": 31.0, "f3": 0.2867, "f3_score": 28.7, "tpr": 0.2667, "fpr": 0.2, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 51.4, "cvss_fp_weight": 5.3, "cvss_fn_weight": 127.7, "cvss_precision": 0.907, "cvss_recall": 0.287, "cvss_f3": 0.308, "cvss_f3_score": 30.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "medium": { "tp": 4, "fp": 0, "fn": 14, "recall": 0.2222 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-100", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-227", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 17, "fp": 17, "fn": 13, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.5667, "f1": 0.5312, "f2": 0.5519, "f2_score": 55.2, "f3": 0.5592, "f3_score": 55.9, "tpr": 0.5667, "fpr": 0.85, "youden_j": -0.2833, "cvss_coverage": 1.0, "cvss_tp_weight": 102.1, "cvss_fp_weight": 75.2, "cvss_fn_weight": 77.0, "cvss_precision": 0.5757, "cvss_recall": 0.5701, "cvss_f3": 0.5706, "cvss_f3_score": 57.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 1, "fn": 4, "recall": 0.6364 }, "medium": { "tp": 9, "fp": 0, "fn": 9, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": "clinic_portal/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": "portal/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-101", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": "portal/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-284" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-267", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 14, "fn": 18, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.4, "f1": 0.4286, "f2": 0.411, "f2_score": 41.1, "f3": 0.4054, "f3_score": 40.5, "tpr": 0.4, "fpr": 0.8235, "youden_j": -0.4235, "cvss_coverage": 1.0, "cvss_tp_weight": 74.8, "cvss_fp_weight": 59.4, "cvss_fn_weight": 104.3, "cvss_precision": 0.5572, "cvss_recall": 0.4176, "cvss_f3": 0.4284, "cvss_f3_score": 42.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "medium": { "tp": 7, "fp": 1, "fn": 11, "recall": 0.3889 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-167", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-663", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-713", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-721", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-102", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-227", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-673", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "rowan": { "scanner": "rowan", "tp": 4, "fp": 48, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0769, "recall": 0.1333, "f1": 0.0976, "f2": 0.1163, "f2_score": 11.6, "f3": 0.1242, "f3_score": 12.4, "tpr": 0.1333, "fpr": 0.9231, "youden_j": -0.7897, "cvss_coverage": 1.0, "cvss_tp_weight": 28.4, "cvss_fp_weight": 114.5, "cvss_fn_weight": 150.7, "cvss_precision": 0.1987, "cvss_recall": 0.1586, "cvss_f3": 0.1618, "cvss_f3_score": 16.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "medium": { "tp": 2, "fp": 0, "fn": 16, "recall": 0.1111 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-302", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-684", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-100", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-167", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-227", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 19, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8261, "youden_j": -0.8261, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 100.1, "cvss_fn_weight": 179.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 18, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/clinic_portal/patient_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/portal/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/portal/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/appointment_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/document_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/message_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/password_change.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/prescription_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/profile.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/provider_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-healthcare-clinic-django/templates/portal/visit_summary_form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-100", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-167", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-227", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-267", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-684", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-703", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-732", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 4, "fp": 111, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0348, "recall": 0.1333, "f1": 0.0552, "f2": 0.0851, "f2_score": 8.5, "f3": 0.1039, "f3_score": 10.4, "tpr": 0.1333, "fpr": 0.9652, "youden_j": -0.8319, "cvss_coverage": 1.0, "cvss_tp_weight": 24.2, "cvss_fp_weight": 593.2, "cvss_fn_weight": 154.9, "cvss_precision": 0.0392, "cvss_recall": 0.1351, "cvss_f3": 0.1086, "cvss_f3_score": 10.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.0556 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 10, "recall": 0.0909 }, "medium": { "tp": 3, "fp": 0, "fn": 15, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-100", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-267", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-703", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-732", "file": "clinic_portal/patient_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/patient_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clinic_portal/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "portal/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-101", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-102", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-141", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-167", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-227", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-302", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-345", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-653", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-663", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-673", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-684", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-693", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-713", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-721", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-743", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-healthcare-clinic-django-enrich-011", "file": null, "cwe": "CWE-862" } ] } }, "vc-kimi-code-seeded-v2-hr-payroll-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 17, "fp": 15, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5312, "recall": 0.5862, "f1": 0.5574, "f2": 0.5743, "f2_score": 57.4, "f3": 0.5802, "f3_score": 58.0, "tpr": 0.5862, "fpr": 0.7895, "youden_j": -0.2033, "cvss_coverage": 1.0, "cvss_tp_weight": 103.7, "cvss_fp_weight": 75.4, "cvss_fn_weight": 72.8, "cvss_precision": 0.5791, "cvss_recall": 0.5875, "cvss_f3": 0.5867, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-744", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 13, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5517, "recall": 0.5517, "f1": 0.5517, "f2": 0.5517, "f2_score": 55.2, "f3": 0.5517, "f3_score": 55.2, "tpr": 0.5517, "fpr": 0.7647, "youden_j": -0.213, "cvss_coverage": 1.0, "cvss_tp_weight": 102.7, "cvss_fp_weight": 40.4, "cvss_fn_weight": 73.8, "cvss_precision": 0.7175, "cvss_recall": 0.5819, "cvss_f3": 0.5931, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 15, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.5172, "f1": 0.6122, "f2": 0.5515, "f2_score": 55.1, "f3": 0.5338, "f3_score": 53.4, "tpr": 0.5172, "fpr": 0.5556, "youden_j": -0.0383, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 26.7, "cvss_fn_weight": 83.5, "cvss_precision": 0.7767, "cvss_recall": 0.5269, "cvss_f3": 0.5444, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 9, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.625, "recall": 0.5172, "f1": 0.566, "f2": 0.5357, "f2_score": 53.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5172, "fpr": 0.6923, "youden_j": -0.1751, "cvss_coverage": 1.0, "cvss_tp_weight": 94.1, "cvss_fp_weight": 43.3, "cvss_fn_weight": 82.4, "cvss_precision": 0.6849, "cvss_recall": 0.5331, "cvss_f3": 0.5452, "cvss_f3_score": 54.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 10, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.5517, "f1": 0.5818, "f2": 0.5634, "f2_score": 56.3, "f3": 0.5575, "f3_score": 55.7, "tpr": 0.5517, "fpr": 0.7143, "youden_j": -0.1626, "cvss_coverage": 1.0, "cvss_tp_weight": 99.4, "cvss_fp_weight": 48.6, "cvss_fn_weight": 77.1, "cvss_precision": 0.6715, "cvss_recall": 0.5632, "cvss_f3": 0.5724, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 1, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9083, "recall": 0.3448, "f1": 0.499, "f2": 0.3934, "f2_score": 39.4, "f3": 0.3675, "f3_score": 36.8, "tpr": 0.3448, "fpr": 0.2, "youden_j": 0.1448, "cvss_coverage": 1.0, "cvss_tp_weight": 65.8, "cvss_fp_weight": 5.3, "cvss_fn_weight": 110.7, "cvss_precision": 0.9242, "cvss_recall": 0.3728, "cvss_f3": 0.3963, "cvss_f3_score": 39.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 7, "fp": 2, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.2414, "f1": 0.3684, "f2": 0.28, "f2_score": 28.0, "f3": 0.2593, "f3_score": 25.9, "tpr": 0.2414, "fpr": 0.3333, "youden_j": -0.092, "cvss_coverage": 1.0, "cvss_tp_weight": 48.3, "cvss_fp_weight": 5.8, "cvss_fn_weight": 128.2, "cvss_precision": 0.892, "cvss_recall": 0.2737, "cvss_f3": 0.294, "cvss_f3_score": 29.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 12, "recall": 0.1429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 12, "fp": 7, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6353, "recall": 0.4138, "f1": 0.5004, "f2": 0.4445, "f2_score": 44.4, "f3": 0.4286, "f3_score": 42.9, "tpr": 0.4138, "fpr": 0.6512, "youden_j": -0.2374, "cvss_coverage": 1.0, "cvss_tp_weight": 75.9, "cvss_fp_weight": 34.2, "cvss_fn_weight": 100.6, "cvss_precision": 0.6907, "cvss_recall": 0.43, "cvss_f3": 0.4468, "cvss_f3_score": 44.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 15, "fp": 16, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5024, "recall": 0.5288, "f1": 0.5109, "f2": 0.5204, "f2_score": 52.0, "f3": 0.5243, "f3_score": 52.4, "tpr": 0.5288, "fpr": 0.7862, "youden_j": -0.2574, "cvss_coverage": 1.0, "cvss_tp_weight": 95.5, "cvss_fp_weight": 69.2, "cvss_fn_weight": 81.0, "cvss_precision": 0.5903, "cvss_recall": 0.5413, "cvss_f3": 0.5442, "cvss_f3_score": 54.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 16, "fp": 10, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6404, "recall": 0.5632, "f1": 0.5957, "f2": 0.575, "f2_score": 57.5, "f3": 0.5689, "f3_score": 56.9, "tpr": 0.5632, "fpr": 0.6874, "youden_j": -0.1242, "cvss_coverage": 1.0, "cvss_tp_weight": 101.0, "cvss_fp_weight": 42.0, "cvss_fn_weight": 75.5, "cvss_precision": 0.7155, "cvss_recall": 0.5724, "cvss_f3": 0.5834, "cvss_f3_score": 58.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 17, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5278, "recall": 0.6552, "f1": 0.5846, "f2": 0.625, "f2_score": 62.5, "f3": 0.6397, "f3_score": 64.0, "tpr": 0.6552, "fpr": 0.8095, "youden_j": -0.1544, "cvss_coverage": 1.0, "cvss_tp_weight": 118.9, "cvss_fp_weight": 76.4, "cvss_fn_weight": 57.6, "cvss_precision": 0.6089, "cvss_recall": 0.6737, "cvss_f3": 0.6666, "cvss_f3_score": 66.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-521" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 15, "fp": 19, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.443, "recall": 0.5287, "f1": 0.4804, "f2": 0.5078, "f2_score": 50.8, "f3": 0.518, "f3_score": 51.8, "tpr": 0.5287, "fpr": 0.8378, "youden_j": -0.309, "cvss_coverage": 1.0, "cvss_tp_weight": 97.6, "cvss_fp_weight": 92.1, "cvss_fn_weight": 78.9, "cvss_precision": 0.5168, "cvss_recall": 0.5532, "cvss_f3": 0.5483, "cvss_f3_score": 54.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 10, "fp": 5, "fn": 19, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3448, "f1": 0.4545, "f2": 0.3817, "f2_score": 38.2, "f3": 0.3623, "f3_score": 36.2, "tpr": 0.3448, "fpr": 0.5556, "youden_j": -0.2107, "cvss_coverage": 1.0, "cvss_tp_weight": 63.4, "cvss_fp_weight": 12.2, "cvss_fn_weight": 113.1, "cvss_precision": 0.8387, "cvss_recall": 0.3592, "cvss_f3": 0.381, "cvss_f3_score": 38.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 29, "fp": 15, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6591, "recall": 1.0, "f1": 0.7945, "f2": 0.9062, "f2_score": 90.6, "f3": 0.9508, "f3_score": 95.1, "tpr": 1.0, "fpr": 0.7895, "youden_j": 0.2105, "cvss_coverage": 1.0, "cvss_tp_weight": 176.5, "cvss_fp_weight": 80.2, "cvss_fn_weight": 0.0, "cvss_precision": 0.6875, "cvss_recall": 1.0, "cvss_f3": 0.9565, "cvss_f3_score": 95.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-654", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-744", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": "hr_payroll/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.4828, "f1": 0.5714, "f2": 0.5147, "f2_score": 51.5, "f3": 0.4982, "f3_score": 49.8, "tpr": 0.4828, "fpr": 0.6, "youden_j": -0.1172, "cvss_coverage": 1.0, "cvss_tp_weight": 90.8, "cvss_fp_weight": 27.2, "cvss_fn_weight": 85.7, "cvss_precision": 0.7692, "cvss_recall": 0.5144, "cvss_f3": 0.5321, "cvss_f3_score": 53.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 14, "fp": 24, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3684, "recall": 0.4828, "f1": 0.4179, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4682, "f3_score": 46.8, "tpr": 0.4828, "fpr": 0.8571, "youden_j": -0.3744, "cvss_coverage": 1.0, "cvss_tp_weight": 93.2, "cvss_fp_weight": 113.8, "cvss_fn_weight": 83.3, "cvss_precision": 0.4502, "cvss_recall": 0.528, "cvss_f3": 0.5191, "cvss_f3_score": 51.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 28, "fp": 20, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.9655, "f1": 0.7273, "f2": 0.8537, "f2_score": 85.4, "f3": 0.9061, "f3_score": 90.6, "tpr": 0.9655, "fpr": 0.8333, "youden_j": 0.1322, "cvss_coverage": 1.0, "cvss_tp_weight": 172.2, "cvss_fp_weight": 97.3, "cvss_fn_weight": 4.3, "cvss_precision": 0.639, "cvss_recall": 0.9756, "cvss_f3": 0.9268, "cvss_f3_score": 92.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-654", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": "hr_payroll/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 4, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7833, "recall": 0.4483, "f1": 0.5677, "f2": 0.4892, "f2_score": 48.9, "f3": 0.4678, "f3_score": 46.8, "tpr": 0.4483, "fpr": 0.4709, "youden_j": -0.0226, "cvss_coverage": 1.0, "cvss_tp_weight": 80.8, "cvss_fp_weight": 9.9, "cvss_fn_weight": 95.7, "cvss_precision": 0.8885, "cvss_recall": 0.4576, "cvss_f3": 0.4809, "cvss_f3_score": 48.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 8, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.632, "recall": 0.4483, "f1": 0.5219, "f2": 0.4747, "f2_score": 47.5, "f3": 0.461, "f3_score": 46.1, "tpr": 0.4483, "fpr": 0.6444, "youden_j": -0.1962, "cvss_coverage": 1.0, "cvss_tp_weight": 81.1, "cvss_fp_weight": 25.8, "cvss_fn_weight": 95.4, "cvss_precision": 0.7636, "cvss_recall": 0.4595, "cvss_f3": 0.4783, "cvss_f3_score": 47.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 11, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5854, "recall": 0.5402, "f1": 0.5597, "f2": 0.5473, "f2_score": 54.7, "f3": 0.5437, "f3_score": 54.3, "tpr": 0.5402, "fpr": 0.732, "youden_j": -0.1918, "cvss_coverage": 1.0, "cvss_tp_weight": 97.6, "cvss_fp_weight": 39.6, "cvss_fn_weight": 78.9, "cvss_precision": 0.7212, "cvss_recall": 0.553, "cvss_f3": 0.5653, "cvss_f3_score": 56.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 5, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8077, "recall": 0.7241, "f1": 0.7636, "f2": 0.7394, "f2_score": 73.9, "f3": 0.7317, "f3_score": 73.2, "tpr": 0.7241, "fpr": 0.5556, "youden_j": 0.1686, "cvss_coverage": 1.0, "cvss_tp_weight": 125.6, "cvss_fp_weight": 7.3, "cvss_fn_weight": 50.9, "cvss_precision": 0.9447, "cvss_recall": 0.7116, "cvss_f3": 0.7296, "cvss_f3_score": 73.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-654", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-744", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 12, "fp": 18, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.4138, "f1": 0.4068, "f2": 0.411, "f2_score": 41.1, "f3": 0.4124, "f3_score": 41.2, "tpr": 0.4138, "fpr": 0.8182, "youden_j": -0.4044, "cvss_coverage": 1.0, "cvss_tp_weight": 79.7, "cvss_fp_weight": 100.5, "cvss_fn_weight": 96.8, "cvss_precision": 0.4423, "cvss_recall": 0.4516, "cvss_f3": 0.4506, "cvss_f3_score": 45.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 23, "fp": 55, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2949, "recall": 0.7931, "f1": 0.4299, "f2": 0.5928, "f2_score": 59.3, "f3": 0.6785, "f3_score": 67.8, "tpr": 0.7931, "fpr": 0.9483, "youden_j": -0.1552, "cvss_coverage": 1.0, "cvss_tp_weight": 139.6, "cvss_fp_weight": 382.0, "cvss_fn_weight": 36.9, "cvss_precision": 0.2676, "cvss_recall": 0.7909, "cvss_f3": 0.6616, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 1, "fn": 4, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": "hr_payroll/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/decorators.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "core/mixins.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": "documents/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-186", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 19, "fp": 40, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.322, "recall": 0.6552, "f1": 0.4318, "f2": 0.5429, "f2_score": 54.3, "f3": 0.5937, "f3_score": 59.4, "tpr": 0.6552, "fpr": 0.9091, "youden_j": -0.2539, "cvss_coverage": 1.0, "cvss_tp_weight": 118.1, "cvss_fp_weight": 281.0, "cvss_fn_weight": 58.4, "cvss_precision": 0.2959, "cvss_recall": 0.6691, "cvss_f3": 0.5942, "cvss_f3_score": 59.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 2, "fp": 4, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.069, "f1": 0.1143, "f2": 0.082, "f2_score": 8.2, "f3": 0.0749, "f3_score": 7.5, "tpr": 0.069, "fpr": 0.5, "youden_j": -0.431, "cvss_coverage": 1.0, "cvss_tp_weight": 15.0, "cvss_fp_weight": 27.0, "cvss_fn_weight": 161.5, "cvss_precision": 0.3571, "cvss_recall": 0.085, "cvss_f3": 0.092, "cvss_f3_score": 9.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-105", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-186", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-685", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-714", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 23, "fp": 59, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2805, "recall": 0.7931, "f1": 0.4144, "f2": 0.5808, "f2_score": 58.1, "f3": 0.6706, "f3_score": 67.1, "tpr": 0.7931, "fpr": 0.9365, "youden_j": -0.1434, "cvss_coverage": 1.0, "cvss_tp_weight": 141.9, "cvss_fp_weight": 397.0, "cvss_fn_weight": 34.6, "cvss_precision": 0.2633, "cvss_recall": 0.804, "cvss_f3": 0.667, "cvss_f3_score": 66.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 13, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6829, "recall": 0.9655, "f1": 0.8, "f2": 0.8917, "f2_score": 89.2, "f3": 0.9272, "f3_score": 92.7, "tpr": 0.9655, "fpr": 0.7647, "youden_j": 0.2008, "cvss_coverage": 1.0, "cvss_tp_weight": 172.2, "cvss_fp_weight": 94.0, "cvss_fn_weight": 4.3, "cvss_precision": 0.6469, "cvss_recall": 0.9756, "cvss_f3": 0.9285, "cvss_f3_score": 92.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9412 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-654", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-744", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": "hr_payroll/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/employees/notification_list.html", "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 20, "fp": 65, "fn": 9, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2353, "recall": 0.6897, "f1": 0.3509, "f2": 0.4975, "f2_score": 49.8, "f3": 0.578, "f3_score": 57.8, "tpr": 0.6897, "fpr": 0.9559, "youden_j": -0.2662, "cvss_coverage": 1.0, "cvss_tp_weight": 128.2, "cvss_fp_weight": 379.0, "cvss_fn_weight": 48.3, "cvss_precision": 0.2528, "cvss_recall": 0.7263, "cvss_f3": 0.6117, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 1, "fn": 5, "recall": 0.5833 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": "hr_payroll/settings.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/urls.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": "hr_payroll/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": "employees/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 23, "fp": 78, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2277, "recall": 0.7931, "f1": 0.3538, "f2": 0.53, "f2_score": 53.0, "f3": 0.6354, "f3_score": 63.5, "tpr": 0.7931, "fpr": 0.9512, "youden_j": -0.1581, "cvss_coverage": 1.0, "cvss_tp_weight": 141.9, "cvss_fp_weight": 503.0, "cvss_fn_weight": 34.6, "cvss_precision": 0.22, "cvss_recall": 0.804, "cvss_f3": 0.6354, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "low": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/utils.py", "cwe": "CWE-348" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-1287" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": "employees/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-257" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-142", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-353", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-694", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 1, "fp": 6, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1429, "recall": 0.0345, "f1": 0.0556, "f2": 0.0407, "f2_score": 4.1, "f3": 0.0373, "f3_score": 3.7, "tpr": 0.0345, "fpr": 0.6, "youden_j": -0.5655, "cvss_coverage": 1.0, "cvss_tp_weight": 9.1, "cvss_fp_weight": 27.2, "cvss_fn_weight": 167.4, "cvss_precision": 0.2504, "cvss_recall": 0.0516, "cvss_f3": 0.056, "cvss_f3_score": 5.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-105", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-186", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-268", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-685", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-714", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 13, "fp": 15, "fn": 16, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4643, "recall": 0.4483, "f1": 0.4561, "f2": 0.4514, "f2_score": 45.1, "f3": 0.4498, "f3_score": 45.0, "tpr": 0.4483, "fpr": 0.8333, "youden_j": -0.3851, "cvss_coverage": 1.0, "cvss_tp_weight": 79.6, "cvss_fp_weight": 75.4, "cvss_fn_weight": 96.9, "cvss_precision": 0.5136, "cvss_recall": 0.451, "cvss_f3": 0.4566, "cvss_f3_score": 45.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 7, "fp": 1, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-104", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 10, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.4138, "f1": 0.4706, "f2": 0.4348, "f2_score": 43.5, "f3": 0.424, "f3_score": 42.4, "tpr": 0.4138, "fpr": 0.7143, "youden_j": -0.3005, "cvss_coverage": 1.0, "cvss_tp_weight": 77.4, "cvss_fp_weight": 43.8, "cvss_fn_weight": 99.1, "cvss_precision": 0.6387, "cvss_recall": 0.4385, "cvss_f3": 0.4527, "cvss_f3_score": 45.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.25 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "low": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-722", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-714", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-664", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-674", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-103", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-246", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "api/models.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": "hr_payroll/settings.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "rowan": { "scanner": "rowan", "tp": 5, "fp": 65, "fn": 24, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0714, "recall": 0.1724, "f1": 0.101, "f2": 0.1344, "f2_score": 13.4, "f3": 0.1511, "f3_score": 15.1, "tpr": 0.1724, "fpr": 0.9559, "youden_j": -0.7835, "cvss_coverage": 1.0, "cvss_tp_weight": 37.2, "cvss_fp_weight": 320.5, "cvss_fn_weight": 139.3, "cvss_precision": 0.104, "cvss_recall": 0.2108, "cvss_f3": 0.1911, "cvss_f3_score": 19.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 2, "fp": 1, "fn": 12, "recall": 0.1429 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": "employees/views.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-303", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-685", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-105", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-714", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 22, "fn": 29, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8462, "youden_j": -0.8462, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 117.7, "cvss_fn_weight": 176.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/employees/management/commands/seed_data.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/hr_payroll/payroll_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/api/api_settings.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/employees/department_create.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/employees/import_data.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-hr-payroll-django/templates/hr_requests/request_detail.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-105", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-186", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-268", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-685", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-704", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-714", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-733", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 113, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0424, "recall": 0.1724, "f1": 0.068, "f2": 0.1068, "f2_score": 10.7, "f3": 0.1319, "f3_score": 13.2, "tpr": 0.1724, "fpr": 0.9658, "youden_j": -0.7934, "cvss_coverage": 1.0, "cvss_tp_weight": 31.9, "cvss_fp_weight": 612.7, "cvss_fn_weight": 144.6, "cvss_precision": 0.0495, "cvss_recall": 0.1807, "cvss_f3": 0.1429, "cvss_f3_score": 14.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "low": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "audit/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "compensation/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "core/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/management/commands/seed_data.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "employees/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-105", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-186", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-268", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-704", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-733", "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/payroll_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_payroll/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "hr_requests/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "onboarding/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "policies/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-103", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-104", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-142", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-246", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-303", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-353", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-654", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-664", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-674", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-685", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-694", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-714", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-722", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-744", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-002", "file": null, "cwe": "CWE-215" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-003", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-007", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-008", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-hr-payroll-django-fp-004", "file": null, "cwe": "CWE-915" } ] } }, "vc-kimi-code-seeded-v2-legal-case-django": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 20, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.7692, "f1": 0.6061, "f2": 0.6944, "f2_score": 69.4, "f3": 0.7299, "f3_score": 73.0, "tpr": 0.7692, "fpr": 0.8333, "youden_j": -0.0641, "cvss_coverage": 1.0, "cvss_tp_weight": 122.0, "cvss_fp_weight": 90.4, "cvss_fn_weight": 34.9, "cvss_precision": 0.5745, "cvss_recall": 0.7776, "cvss_f3": 0.751, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-745", "file": "legalcase/case_operations.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-1392" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 4, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8261, "recall": 0.7308, "f1": 0.7755, "f2": 0.748, "f2_score": 74.8, "f3": 0.7393, "f3_score": 73.9, "tpr": 0.7308, "fpr": 0.5, "youden_j": 0.2308, "cvss_coverage": 1.0, "cvss_tp_weight": 116.6, "cvss_fp_weight": 12.0, "cvss_fn_weight": 40.3, "cvss_precision": 0.9064, "cvss_recall": 0.7431, "cvss_f3": 0.7568, "cvss_f3_score": 75.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 5, "fn": 12, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.7368, "recall": 0.5385, "f1": 0.6222, "f2": 0.5691, "f2_score": 56.9, "f3": 0.5534, "f3_score": 55.3, "tpr": 0.5385, "fpr": 0.625, "youden_j": -0.0865, "cvss_coverage": 1.0, "cvss_tp_weight": 88.3, "cvss_fp_weight": 22.6, "cvss_fn_weight": 68.6, "cvss_precision": 0.7963, "cvss_recall": 0.5628, "cvss_f3": 0.5798, "cvss_f3_score": 58.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 1, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": "legalcase/case_operations.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.5385, "f1": 0.6364, "f2": 0.5738, "f2_score": 57.4, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5385, "fpr": 0.5, "youden_j": 0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 94.8, "cvss_fp_weight": 12.0, "cvss_fn_weight": 62.1, "cvss_precision": 0.8873, "cvss_recall": 0.6042, "cvss_f3": 0.6241, "cvss_f3_score": 62.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/utils.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 22, "fp": 19, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5366, "recall": 0.8462, "f1": 0.6567, "f2": 0.7586, "f2_score": 75.9, "f3": 0.8, "f3_score": 80.0, "tpr": 0.8462, "fpr": 0.8261, "youden_j": 0.0201, "cvss_coverage": 1.0, "cvss_tp_weight": 136.7, "cvss_fp_weight": 89.9, "cvss_fn_weight": 20.2, "cvss_precision": 0.6033, "cvss_recall": 0.8713, "cvss_f3": 0.8342, "cvss_f3_score": 83.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.6667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-745", "file": "legalcase/case_operations.py", "cwe": "CWE-215" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9667, "recall": 0.3718, "f1": 0.5371, "f2": 0.424, "f2_score": 42.4, "f3": 0.3962, "f3_score": 39.6, "tpr": 0.3718, "fpr": 0.0667, "youden_j": 0.3051, "cvss_coverage": 1.0, "cvss_tp_weight": 68.3, "cvss_fp_weight": 1.8, "cvss_fn_weight": 88.6, "cvss_precision": 0.9734, "cvss_recall": 0.4355, "cvss_f3": 0.461, "cvss_f3_score": 46.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 156.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-187", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-269", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-686", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-695", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-736", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8007, "recall": 0.5385, "f1": 0.6426, "f2": 0.5756, "f2_score": 57.6, "f3": 0.5564, "f3_score": 55.6, "tpr": 0.5385, "fpr": 0.4333, "youden_j": 0.1051, "cvss_coverage": 1.0, "cvss_tp_weight": 89.4, "cvss_fp_weight": 16.9, "cvss_fn_weight": 67.5, "cvss_precision": 0.8464, "cvss_recall": 0.5696, "cvss_f3": 0.5886, "cvss_f3_score": 58.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 18, "fp": 6, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7397, "recall": 0.6795, "f1": 0.7077, "f2": 0.6904, "f2_score": 69.1, "f3": 0.6849, "f3_score": 68.5, "tpr": 0.6795, "fpr": 0.6012, "youden_j": 0.0784, "cvss_coverage": 1.0, "cvss_tp_weight": 110.7, "cvss_fp_weight": 26.6, "cvss_fn_weight": 46.2, "cvss_precision": 0.8116, "cvss_recall": 0.7058, "cvss_f3": 0.7148, "cvss_f3_score": 71.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 19, "fp": 14, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5824, "recall": 0.7308, "f1": 0.6465, "f2": 0.694, "f2_score": 69.4, "f3": 0.7118, "f3_score": 71.2, "tpr": 0.7308, "fpr": 0.7684, "youden_j": -0.0376, "cvss_coverage": 1.0, "cvss_tp_weight": 119.8, "cvss_fp_weight": 57.2, "cvss_fn_weight": 37.1, "cvss_precision": 0.6849, "cvss_recall": 0.7635, "cvss_f3": 0.754, "cvss_f3_score": 75.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 18, "fp": 17, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5143, "recall": 0.6923, "f1": 0.5902, "f2": 0.6475, "f2_score": 64.7, "f3": 0.6691, "f3_score": 66.9, "tpr": 0.6923, "fpr": 0.8095, "youden_j": -0.1172, "cvss_coverage": 1.0, "cvss_tp_weight": 112.9, "cvss_fp_weight": 78.8, "cvss_fn_weight": 44.0, "cvss_precision": 0.5889, "cvss_recall": 0.7196, "cvss_f3": 0.7039, "cvss_f3_score": 70.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 12, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6054, "recall": 0.7051, "f1": 0.6508, "f2": 0.6821, "f2_score": 68.2, "f3": 0.6934, "f3_score": 69.4, "tpr": 0.7051, "fpr": 0.7481, "youden_j": -0.043, "cvss_coverage": 1.0, "cvss_tp_weight": 117.1, "cvss_fp_weight": 51.2, "cvss_fn_weight": 39.8, "cvss_precision": 0.6963, "cvss_recall": 0.7461, "cvss_f3": 0.7406, "cvss_f3_score": 74.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 14, "fp": 4, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7778, "recall": 0.5385, "f1": 0.6364, "f2": 0.5738, "f2_score": 57.4, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5385, "fpr": 0.5, "youden_j": 0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 90.3, "cvss_fp_weight": 7.0, "cvss_fn_weight": 66.6, "cvss_precision": 0.9278, "cvss_recall": 0.5755, "cvss_f3": 0.5982, "cvss_f3_score": 59.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 6, "recall": 0.4545 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 25, "fp": 19, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5682, "recall": 0.9615, "f1": 0.7143, "f2": 0.8446, "f2_score": 84.5, "f3": 0.8993, "f3_score": 89.9, "tpr": 0.9615, "fpr": 0.8261, "youden_j": 0.1355, "cvss_coverage": 1.0, "cvss_tp_weight": 150.4, "cvss_fp_weight": 99.9, "cvss_fn_weight": 6.5, "cvss_precision": 0.6008, "cvss_recall": 0.9586, "cvss_f3": 0.9047, "cvss_f3_score": 90.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-655", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-745", "file": "legalcase/case_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/utils.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 16, "fp": 6, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7273, "recall": 0.6154, "f1": 0.6667, "f2": 0.6349, "f2_score": 63.5, "f3": 0.625, "f3_score": 62.5, "tpr": 0.6154, "fpr": 0.6, "youden_j": 0.0154, "cvss_coverage": 1.0, "cvss_tp_weight": 104.4, "cvss_fp_weight": 23.1, "cvss_fn_weight": 52.5, "cvss_precision": 0.8189, "cvss_recall": 0.6654, "cvss_f3": 0.6781, "cvss_f3_score": 67.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 26, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.381, "recall": 0.6154, "f1": 0.4706, "f2": 0.5479, "f2_score": 54.8, "f3": 0.5797, "f3_score": 58.0, "tpr": 0.6154, "fpr": 0.8667, "youden_j": -0.2513, "cvss_coverage": 1.0, "cvss_tp_weight": 104.8, "cvss_fp_weight": 128.5, "cvss_fn_weight": 52.1, "cvss_precision": 0.4491, "cvss_recall": 0.6679, "cvss_f3": 0.6369, "cvss_f3_score": 63.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/forms.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/forms.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/forms.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/utils.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/forms.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 26, "fp": 14, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.65, "recall": 1.0, "f1": 0.7879, "f2": 0.9028, "f2_score": 90.3, "f3": 0.9489, "f3_score": 94.9, "tpr": 1.0, "fpr": 0.7778, "youden_j": 0.2222, "cvss_coverage": 1.0, "cvss_tp_weight": 156.9, "cvss_fp_weight": 77.3, "cvss_fn_weight": 0.0, "cvss_precision": 0.6699, "cvss_recall": 1.0, "cvss_f3": 0.953, "cvss_f3_score": 95.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 0, "recall": 1.0 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-655", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-745", "file": "legalcase/case_operations.py", "cwe": "CWE-215" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 12, "fp": 3, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8196, "recall": 0.4615, "f1": 0.5825, "f2": 0.5023, "f2_score": 50.2, "f3": 0.4809, "f3_score": 48.1, "tpr": 0.4615, "fpr": 0.3556, "youden_j": 0.106, "cvss_coverage": 1.0, "cvss_tp_weight": 77.6, "cvss_fp_weight": 11.7, "cvss_fn_weight": 79.3, "cvss_precision": 0.8882, "cvss_recall": 0.4944, "cvss_f3": 0.5164, "cvss_f3_score": 51.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 7, "recall": 0.3636 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 15, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6451, "recall": 0.5769, "f1": 0.607, "f2": 0.5882, "f2_score": 58.8, "f3": 0.5824, "f3_score": 58.2, "tpr": 0.5769, "fpr": 0.6548, "youden_j": -0.0778, "cvss_coverage": 1.0, "cvss_tp_weight": 95.4, "cvss_fp_weight": 32.8, "cvss_fn_weight": 61.5, "cvss_precision": 0.7478, "cvss_recall": 0.6078, "cvss_f3": 0.6191, "cvss_f3_score": 61.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 10, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6343, "recall": 0.6282, "f1": 0.6271, "f2": 0.6268, "f2_score": 62.7, "f3": 0.6273, "f3_score": 62.7, "tpr": 0.6282, "fpr": 0.6889, "youden_j": -0.0607, "cvss_coverage": 1.0, "cvss_tp_weight": 104.7, "cvss_fp_weight": 40.2, "cvss_fn_weight": 52.2, "cvss_precision": 0.7327, "cvss_recall": 0.6675, "cvss_f3": 0.6726, "cvss_f3_score": 67.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 8, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7692, "f1": 0.7407, "f2": 0.7576, "f2_score": 75.8, "f3": 0.7634, "f3_score": 76.3, "tpr": 0.7692, "fpr": 0.6667, "youden_j": 0.1026, "cvss_coverage": 1.0, "cvss_tp_weight": 124.0, "cvss_fp_weight": 29.1, "cvss_fn_weight": 32.9, "cvss_precision": 0.8098, "cvss_recall": 0.7903, "cvss_f3": 0.7922, "cvss_f3_score": 79.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 21, "fp": 22, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4884, "recall": 0.8077, "f1": 0.6087, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7581, "f3_score": 75.8, "tpr": 0.8077, "fpr": 0.8462, "youden_j": -0.0385, "cvss_coverage": 1.0, "cvss_tp_weight": 127.9, "cvss_fp_weight": 104.5, "cvss_fn_weight": 29.0, "cvss_precision": 0.5503, "cvss_recall": 0.8152, "cvss_f3": 0.7777, "cvss_f3_score": 77.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/utils.py", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-248" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 21, "fp": 61, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2561, "recall": 0.8077, "f1": 0.3889, "f2": 0.5645, "f2_score": 56.5, "f3": 0.6646, "f3_score": 66.5, "tpr": 0.8077, "fpr": 0.9385, "youden_j": -0.1308, "cvss_coverage": 1.0, "cvss_tp_weight": 132.2, "cvss_fp_weight": 425.0, "cvss_fn_weight": 24.7, "cvss_precision": 0.2373, "cvss_recall": 0.8426, "cvss_f3": 0.6713, "cvss_f3_score": 67.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-256" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 20, "fp": 39, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.339, "recall": 0.7692, "f1": 0.4706, "f2": 0.6135, "f2_score": 61.3, "f3": 0.6826, "f3_score": 68.3, "tpr": 0.7692, "fpr": 0.907, "youden_j": -0.1377, "cvss_coverage": 1.0, "cvss_tp_weight": 122.3, "cvss_fp_weight": 275.0, "cvss_fn_weight": 34.6, "cvss_precision": 0.3078, "cvss_recall": 0.7795, "cvss_f3": 0.6759, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 8, "fp": 8, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.3077, "f1": 0.381, "f2": 0.3333, "f2_score": 33.3, "f3": 0.32, "f3_score": 32.0, "tpr": 0.3077, "fpr": 0.6667, "youden_j": -0.359, "cvss_coverage": 1.0, "cvss_tp_weight": 55.3, "cvss_fp_weight": 54.0, "cvss_fn_weight": 101.6, "cvss_precision": 0.5059, "cvss_recall": 0.3525, "cvss_f3": 0.3635, "cvss_f3_score": 36.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.1667 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 7, "fp": 0, "fn": 4, "recall": 0.6364 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-686", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-695", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-736", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 22, "fp": 69, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2418, "recall": 0.8462, "f1": 0.3761, "f2": 0.5641, "f2_score": 56.4, "f3": 0.6769, "f3_score": 67.7, "tpr": 0.8462, "fpr": 0.9583, "youden_j": -0.1122, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 496.5, "cvss_fn_weight": 21.6, "cvss_precision": 0.2142, "cvss_recall": 0.8623, "cvss_f3": 0.662, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": "documents/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/accounts/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/clients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/notes/client_message_form.html", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/notes/privileged_note_form.html", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 21, "fp": 10, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6774, "recall": 0.8077, "f1": 0.7368, "f2": 0.7778, "f2_score": 77.8, "f3": 0.7925, "f3_score": 79.2, "tpr": 0.8077, "fpr": 0.7143, "youden_j": 0.0934, "cvss_coverage": 1.0, "cvss_tp_weight": 127.5, "cvss_fp_weight": 70.0, "cvss_fn_weight": 29.4, "cvss_precision": 0.6456, "cvss_recall": 0.8126, "cvss_f3": 0.7921, "cvss_f3_score": 79.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 3, "recall": 0.7273 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/urls.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-655", "file": "legalcase/case_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-745", "file": "legalcase/case_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 18, "fp": 56, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2432, "recall": 0.6923, "f1": 0.36, "f2": 0.5056, "f2_score": 50.6, "f3": 0.5844, "f3_score": 58.4, "tpr": 0.6923, "fpr": 0.9333, "youden_j": -0.241, "cvss_coverage": 1.0, "cvss_tp_weight": 109.8, "cvss_fp_weight": 337.0, "cvss_fn_weight": 47.1, "cvss_precision": 0.2457, "cvss_recall": 0.6998, "cvss_f3": 0.5907, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.5833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 9, "fp": 0, "fn": 2, "recall": 0.8182 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/forms.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/urls.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/forms.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-695", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 22, "fp": 94, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1897, "recall": 0.8462, "f1": 0.3099, "f2": 0.5, "f2_score": 50.0, "f3": 0.6286, "f3_score": 62.9, "tpr": 0.8462, "fpr": 0.9691, "youden_j": -0.1229, "cvss_coverage": 1.0, "cvss_tp_weight": 135.3, "cvss_fp_weight": 635.5, "cvss_fn_weight": 21.6, "cvss_precision": 0.1755, "cvss_recall": 0.8623, "cvss_f3": 0.6198, "cvss_f3_score": 62.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 1, "recall": 0.9091 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-1392" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": "documents/views.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/accounts/views.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/api/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-107", "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-108", "file": "legalcase/case_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-315", "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/clients/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/deadlines/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/documents/views.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/login.html", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/accounts/notifications.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/notes/client_message_form.html", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/notes/privileged_note_form.html", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 156.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-187", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-269", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-686", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-695", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-736", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 14, "fp": 2, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.875, "recall": 0.5385, "f1": 0.6667, "f2": 0.5833, "f2_score": 58.3, "f3": 0.56, "f3_score": 56.0, "tpr": 0.5385, "fpr": 0.3333, "youden_j": 0.2051, "cvss_coverage": 1.0, "cvss_tp_weight": 89.2, "cvss_fp_weight": 6.0, "cvss_fn_weight": 67.7, "cvss_precision": 0.9367, "cvss_recall": 0.5685, "cvss_f3": 0.5918, "cvss_f3_score": 59.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.4167 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 5, "recall": 0.5455 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-715", "file": "legalcase/case_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-164", "file": "legalcase/case_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-665", "file": "legalcase/case_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-675", "file": "legalcase/case_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-228", "file": "legalcase/case_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-352", "file": "legalcase/case_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/utils.py", "cwe": "CWE-612" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-106", "file": "legalcase/case_operations.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 52, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1034, "recall": 0.2308, "f1": 0.1429, "f2": 0.1852, "f2_score": 18.5, "f3": 0.2055, "f3_score": 20.5, "tpr": 0.2308, "fpr": 0.9286, "youden_j": -0.6978, "cvss_coverage": 1.0, "cvss_tp_weight": 46.5, "cvss_fp_weight": 151.5, "cvss_fn_weight": 110.4, "cvss_precision": 0.2348, "cvss_recall": 0.2964, "cvss_f3": 0.2888, "cvss_f3_score": 28.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.0833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 8, "recall": 0.2727 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-736", "file": "legalcase/case_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-686", "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 25, "fn": 26, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8621, "youden_j": -0.8621, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 138.1, "cvss_fn_weight": 156.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 12, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 11, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/accounts/views.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-704" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/legalcase/case_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/accounts/profile.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/accounts/user_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/clients/client_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/deadlines/deadline_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/documents/document_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/documents/document_version_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/matters/matter_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/matters/practice_area_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/notes/client_message_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/notes/privileged_note_form.html", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-legal-case-django/templates/tasks/task_form.html", "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-187", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-269", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-686", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-695", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-705", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-728", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-736", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 108, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0442, "recall": 0.1923, "f1": 0.0719, "f2": 0.1152, "f2_score": 11.5, "f3": 0.1441, "f3_score": 14.4, "tpr": 0.1923, "fpr": 0.9643, "youden_j": -0.772, "cvss_coverage": 1.0, "cvss_tp_weight": 36.0, "cvss_fp_weight": 608.4, "cvss_fn_weight": 120.9, "cvss_precision": 0.0559, "cvss_recall": 0.2294, "cvss_f3": 0.1751, "cvss_f3_score": 17.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.0833 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 2, "fp": 0, "fn": 9, "recall": 0.1818 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/management/commands/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/tests.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "accounts/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "api/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "auditlog/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "clients/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "deadlines/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "documents/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-187", "file": "legalcase/case_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-269", "file": "legalcase/case_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-606" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-695", "file": "legalcase/case_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-705", "file": "legalcase/case_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-297" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-728", "file": "legalcase/case_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/case_operations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "legalcase/settings.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "matters/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "notes/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "reports/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "tasks/views.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "templates/base.html", "cwe": "CWE-353" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-106", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-107", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-108", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-164", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-228", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-315", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-352", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-655", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-665", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-675", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-686", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-715", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-736", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-745", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-002", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-003", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-004", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-005", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-legal-case-django-enrich-007", "file": null, "cwe": "CWE-862" } ] } }, "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 23, "fp": 16, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5897, "recall": 0.7419, "f1": 0.6571, "f2": 0.7055, "f2_score": 70.6, "f3": 0.7233, "f3_score": 72.3, "tpr": 0.7419, "fpr": 0.8, "youden_j": -0.0581, "cvss_coverage": 1.0, "cvss_tp_weight": 149.7, "cvss_fp_weight": 82.6, "cvss_fn_weight": 45.5, "cvss_precision": 0.6444, "cvss_recall": 0.7669, "cvss_f3": 0.7526, "cvss_f3_score": 75.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-746", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 13, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5938, "recall": 0.6129, "f1": 0.6032, "f2": 0.609, "f2_score": 60.9, "f3": 0.6109, "f3_score": 61.1, "tpr": 0.6129, "fpr": 0.7647, "youden_j": -0.1518, "cvss_coverage": 1.0, "cvss_tp_weight": 128.1, "cvss_fp_weight": 49.1, "cvss_fn_weight": 67.1, "cvss_precision": 0.7228, "cvss_recall": 0.6562, "cvss_f3": 0.6623, "cvss_f3_score": 66.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 14, "fp": 7, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4516, "f1": 0.5385, "f2": 0.4828, "f2_score": 48.3, "f3": 0.4667, "f3_score": 46.7, "tpr": 0.4516, "fpr": 0.6364, "youden_j": -0.1848, "cvss_coverage": 1.0, "cvss_tp_weight": 102.0, "cvss_fp_weight": 40.8, "cvss_fn_weight": 93.2, "cvss_precision": 0.7143, "cvss_recall": 0.5225, "cvss_f3": 0.537, "cvss_f3_score": 53.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 16, "fp": 4, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.5161, "f1": 0.6275, "f2": 0.5556, "f2_score": 55.6, "f3": 0.5351, "f3_score": 53.5, "tpr": 0.5161, "fpr": 0.5, "youden_j": 0.0161, "cvss_coverage": 1.0, "cvss_tp_weight": 106.1, "cvss_fp_weight": 12.7, "cvss_fn_weight": 89.1, "cvss_precision": 0.8934, "cvss_recall": 0.5435, "cvss_f3": 0.5657, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 20, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.6452, "f1": 0.6667, "f2": 0.6536, "f2_score": 65.4, "f3": 0.6494, "f3_score": 64.9, "tpr": 0.6452, "fpr": 0.6923, "youden_j": -0.0471, "cvss_coverage": 1.0, "cvss_tp_weight": 132.4, "cvss_fp_weight": 47.1, "cvss_fn_weight": 62.8, "cvss_precision": 0.7375, "cvss_recall": 0.6783, "cvss_f3": 0.6838, "cvss_f3_score": 68.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-287" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 14, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7281, "recall": 0.4516, "f1": 0.5569, "f2": 0.4885, "f2_score": 48.9, "f3": 0.4693, "f3_score": 46.9, "tpr": 0.4516, "fpr": 0.555, "youden_j": -0.1034, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 31.1, "cvss_fn_weight": 98.4, "cvss_precision": 0.7602, "cvss_recall": 0.4961, "cvss_f3": 0.5138, "cvss_f3_score": 51.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 25, "fp": 41, "fn": 6, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.3788, "recall": 0.8065, "f1": 0.5155, "f2": 0.6579, "f2_score": 65.8, "f3": 0.7246, "f3_score": 72.5, "tpr": 0.8065, "fpr": 0.9318, "youden_j": -0.1254, "cvss_coverage": 1.0, "cvss_tp_weight": 163.0, "cvss_fp_weight": 196.3, "cvss_fn_weight": 32.2, "cvss_precision": 0.4536, "cvss_recall": 0.835, "cvss_f3": 0.7703, "cvss_f3_score": 77.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 1, "recall": 0.9375 }, "medium": { "tp": 8, "fp": 1, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-77" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-143", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-36" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-1188" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/audit_log.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-1188" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 15, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5446, "recall": 0.5914, "f1": 0.5669, "f2": 0.5813, "f2_score": 58.1, "f3": 0.5863, "f3_score": 58.6, "tpr": 0.5914, "fpr": 0.793, "youden_j": -0.2016, "cvss_coverage": 1.0, "cvss_tp_weight": 127.4, "cvss_fp_weight": 64.5, "cvss_fn_weight": 67.8, "cvss_precision": 0.6643, "cvss_recall": 0.6525, "cvss_f3": 0.6535, "cvss_f3_score": 65.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 17, "fp": 1, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9444, "recall": 0.5484, "f1": 0.6939, "f2": 0.5986, "f2_score": 59.9, "f3": 0.5724, "f3_score": 57.2, "tpr": 0.5484, "fpr": 0.2, "youden_j": 0.3484, "cvss_coverage": 1.0, "cvss_tp_weight": 120.8, "cvss_fp_weight": 5.8, "cvss_fn_weight": 74.4, "cvss_precision": 0.954, "cvss_recall": 0.6189, "cvss_f3": 0.6414, "cvss_f3_score": 64.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 26, "fp": 29, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4727, "recall": 0.8387, "f1": 0.6047, "f2": 0.7263, "f2_score": 72.6, "f3": 0.7784, "f3_score": 77.8, "tpr": 0.8387, "fpr": 0.8788, "youden_j": -0.0401, "cvss_coverage": 1.0, "cvss_tp_weight": 170.5, "cvss_fp_weight": 153.0, "cvss_fn_weight": 24.7, "cvss_precision": 0.527, "cvss_recall": 0.8735, "cvss_f3": 0.8196, "cvss_f3_score": 82.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 15, "fp": 0, "fn": 1, "recall": 0.9375 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhook_mock.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 19, "fp": 14, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5758, "recall": 0.6129, "f1": 0.5938, "f2": 0.6051, "f2_score": 60.5, "f3": 0.609, "f3_score": 60.9, "tpr": 0.6129, "fpr": 0.7778, "youden_j": -0.1649, "cvss_coverage": 1.0, "cvss_tp_weight": 129.7, "cvss_fp_weight": 70.9, "cvss_fn_weight": 65.5, "cvss_precision": 0.6464, "cvss_recall": 0.6644, "cvss_f3": 0.6626, "cvss_f3_score": 66.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 4, "recall": 0.75 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 17, "fp": 27, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3864, "recall": 0.5484, "f1": 0.4533, "f2": 0.506, "f2_score": 50.6, "f3": 0.5263, "f3_score": 52.6, "tpr": 0.5484, "fpr": 0.871, "youden_j": -0.3226, "cvss_coverage": 1.0, "cvss_tp_weight": 114.5, "cvss_fp_weight": 152.0, "cvss_fn_weight": 80.7, "cvss_precision": 0.4296, "cvss_recall": 0.5866, "cvss_f3": 0.5659, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-789" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 24, "fp": 28, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4615, "recall": 0.7742, "f1": 0.5783, "f2": 0.6818, "f2_score": 68.2, "f3": 0.7251, "f3_score": 72.5, "tpr": 0.7742, "fpr": 0.875, "youden_j": -0.1008, "cvss_coverage": 1.0, "cvss_tp_weight": 161.4, "cvss_fp_weight": 147.2, "cvss_fn_weight": 33.8, "cvss_precision": 0.523, "cvss_recall": 0.8268, "cvss_f3": 0.7814, "cvss_f3_score": 78.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 5, "fn": 17, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7472, "recall": 0.4516, "f1": 0.5611, "f2": 0.4896, "f2_score": 49.0, "f3": 0.4698, "f3_score": 47.0, "tpr": 0.4516, "fpr": 0.5232, "youden_j": -0.0716, "cvss_coverage": 1.0, "cvss_tp_weight": 93.1, "cvss_fp_weight": 18.5, "cvss_fn_weight": 102.1, "cvss_precision": 0.846, "cvss_recall": 0.4768, "cvss_f3": 0.4981, "cvss_f3_score": 49.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 7, "recall": 0.5625 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 0, "fp": 21, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.84, "youden_j": -0.84, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 106.4, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/audit_log.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 17, "fp": 14, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5493, "recall": 0.5376, "f1": 0.5399, "f2": 0.5378, "f2_score": 53.8, "f3": 0.5376, "f3_score": 53.7, "tpr": 0.5376, "fpr": 0.787, "youden_j": -0.2494, "cvss_coverage": 1.0, "cvss_tp_weight": 110.3, "cvss_fp_weight": 60.5, "cvss_fn_weight": 84.9, "cvss_precision": 0.666, "cvss_recall": 0.5651, "cvss_f3": 0.572, "cvss_f3_score": 57.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 10, "fp": 0, "fn": 6, "recall": 0.625 }, "medium": { "tp": 5, "fp": 1, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6897, "recall": 0.6452, "f1": 0.6667, "f2": 0.6536, "f2_score": 65.4, "f3": 0.6494, "f3_score": 64.9, "tpr": 0.6452, "fpr": 0.6923, "youden_j": -0.0471, "cvss_coverage": 1.0, "cvss_tp_weight": 129.8, "cvss_fp_weight": 41.8, "cvss_fn_weight": 65.4, "cvss_precision": 0.7564, "cvss_recall": 0.665, "cvss_f3": 0.6731, "cvss_f3_score": 67.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 5, "recall": 0.6875 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 7, "fp": 15, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3182, "recall": 0.2258, "f1": 0.2642, "f2": 0.2397, "f2_score": 24.0, "f3": 0.2326, "f3_score": 23.3, "tpr": 0.2258, "fpr": 0.7895, "youden_j": -0.5637, "cvss_coverage": 1.0, "cvss_tp_weight": 46.4, "cvss_fp_weight": 99.0, "cvss_fn_weight": 148.8, "cvss_precision": 0.3191, "cvss_recall": 0.2377, "cvss_f3": 0.2439, "cvss_f3_score": 24.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 27, "fp": 96, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2195, "recall": 0.871, "f1": 0.3506, "f2": 0.5466, "f2_score": 54.7, "f3": 0.6716, "f3_score": 67.2, "tpr": 0.871, "fpr": 0.96, "youden_j": -0.089, "cvss_coverage": 1.0, "cvss_tp_weight": 171.3, "cvss_fp_weight": 682.5, "cvss_fn_weight": 23.9, "cvss_precision": 0.2006, "cvss_recall": 0.8776, "cvss_f3": 0.6562, "cvss_f3_score": 65.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-656", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "README.md", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/webhooks.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 23, "fp": 46, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.7419, "f1": 0.46, "f2": 0.5959, "f2_score": 59.6, "f3": 0.6609, "f3_score": 66.1, "tpr": 0.7419, "fpr": 0.92, "youden_j": -0.1781, "cvss_coverage": 1.0, "cvss_tp_weight": 152.4, "cvss_fp_weight": 310.5, "cvss_fn_weight": 42.8, "cvss_precision": 0.3292, "cvss_recall": 0.7807, "cvss_f3": 0.6866, "cvss_f3_score": 68.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 10, "fp": 4, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.3226, "f1": 0.4444, "f2": 0.3623, "f2_score": 36.2, "f3": 0.3413, "f3_score": 34.1, "tpr": 0.3226, "fpr": 0.5, "youden_j": -0.1774, "cvss_coverage": 1.0, "cvss_tp_weight": 68.3, "cvss_fp_weight": 31.0, "cvss_fn_weight": 126.9, "cvss_precision": 0.6878, "cvss_recall": 0.3499, "cvss_f3": 0.368, "cvss_f3_score": 36.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/customers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 73, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2474, "recall": 0.7742, "f1": 0.375, "f2": 0.543, "f2_score": 54.3, "f3": 0.6383, "f3_score": 63.8, "tpr": 0.7742, "fpr": 0.9481, "youden_j": -0.1739, "cvss_coverage": 1.0, "cvss_tp_weight": 153.4, "cvss_fp_weight": 534.0, "cvss_fn_weight": 41.8, "cvss_precision": 0.2232, "cvss_recall": 0.7859, "cvss_f3": 0.6276, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 3, "recall": 0.8125 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-143", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhook_mock.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Reports.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/RouteDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 16, "fn": 3, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.9032, "f1": 0.7467, "f2": 0.8333, "f2_score": 83.3, "f3": 0.8669, "f3_score": 86.7, "tpr": 0.9032, "fpr": 0.8, "youden_j": 0.1032, "cvss_coverage": 1.0, "cvss_tp_weight": 177.6, "cvss_fp_weight": 120.5, "cvss_fn_weight": 17.6, "cvss_precision": 0.5958, "cvss_recall": 0.9098, "cvss_f3": 0.8643, "cvss_f3_score": 86.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-143", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-656", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-746", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 9, "fp": 11, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.45, "recall": 0.2903, "f1": 0.3529, "f2": 0.3125, "f2_score": 31.3, "f3": 0.301, "f3_score": 30.1, "tpr": 0.2903, "fpr": 0.7333, "youden_j": -0.443, "cvss_coverage": 1.0, "cvss_tp_weight": 57.2, "cvss_fp_weight": 69.5, "cvss_fn_weight": 138.0, "cvss_precision": 0.4515, "cvss_recall": 0.293, "cvss_f3": 0.3037, "cvss_f3_score": 30.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/routes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": "backend/app/routers/audit_log.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": "backend/app/routers/proofs.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 94, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2101, "recall": 0.8065, "f1": 0.3333, "f2": 0.5144, "f2_score": 51.4, "f3": 0.6281, "f3_score": 62.8, "tpr": 0.8065, "fpr": 0.9592, "youden_j": -0.1527, "cvss_coverage": 1.0, "cvss_tp_weight": 162.5, "cvss_fp_weight": 663.0, "cvss_fn_weight": 32.7, "cvss_precision": 0.1969, "cvss_recall": 0.8325, "cvss_f3": 0.6293, "cvss_f3_score": 62.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 2, "recall": 0.875 }, "medium": { "tp": 9, "fp": 0, "fn": 4, "recall": 0.6923 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-109", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-143", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-229", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-316", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-666", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-676", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/admin.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/incidents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/jobs.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/reports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/workers.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/email_mock.py", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/webhook_mock.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-525" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Reports.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/RouteDetail.jsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-525" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 10, "fp": 5, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.3226, "f1": 0.4348, "f2": 0.3597, "f2_score": 36.0, "f3": 0.3401, "f3_score": 34.0, "tpr": 0.3226, "fpr": 0.5556, "youden_j": -0.233, "cvss_coverage": 1.0, "cvss_tp_weight": 72.1, "cvss_fp_weight": 18.5, "cvss_fn_weight": 123.1, "cvss_precision": 0.7959, "cvss_recall": 0.3694, "cvss_f3": 0.3903, "cvss_f3_score": 39.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 8, "fp": 0, "fn": 8, "recall": 0.5 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-110", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-723", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-716", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 0, "fp": 0, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 10, "fp": 18, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3571, "recall": 0.3226, "f1": 0.339, "f2": 0.3289, "f2_score": 32.9, "f3": 0.3257, "f3_score": 32.6, "tpr": 0.3226, "fpr": 0.8182, "youden_j": -0.4956, "cvss_coverage": 1.0, "cvss_tp_weight": 72.2, "cvss_fp_weight": 120.0, "cvss_fn_weight": 123.0, "cvss_precision": 0.3757, "cvss_recall": 0.3699, "cvss_f3": 0.3704, "cvss_f3_score": 37.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.125 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 10, "recall": 0.375 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-681", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-331", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-734", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 7, "fn": 31, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6364, "youden_j": -0.6364, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 35.5, "cvss_fn_weight": 195.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 16, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/dispatch_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-logistics-dispatch-fastapi/backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-111", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-188", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-270", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-696", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-706", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 7, "fp": 27, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2059, "recall": 0.2258, "f1": 0.2154, "f2": 0.2215, "f2_score": 22.2, "f3": 0.2236, "f3_score": 22.4, "tpr": 0.2258, "fpr": 0.871, "youden_j": -0.6452, "cvss_coverage": 1.0, "cvss_tp_weight": 50.6, "cvss_fp_weight": 164.7, "cvss_fn_weight": 144.6, "cvss_precision": 0.235, "cvss_recall": 0.2592, "cvss_f3": 0.2566, "cvss_f3_score": 25.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 5, "fp": 0, "fn": 11, "recall": 0.3125 }, "medium": { "tp": 1, "fp": 0, "fn": 12, "recall": 0.0769 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-111", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-188", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-270", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-696", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dispatch_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-706", "file": "backend/app/dispatch_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/proofs.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.js", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-109", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-110", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-143", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-229", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-316", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-331", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-656", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-666", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-676", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-681", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-716", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-723", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-734", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-746", "file": null, "cwe": "CWE-215" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-002", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-009", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-010", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 21, "fp": 14, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.7778, "f1": 0.6774, "f2": 0.7343, "f2_score": 73.4, "f3": 0.7554, "f3_score": 75.5, "tpr": 0.7778, "fpr": 0.7778, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 128.9, "cvss_fp_weight": 77.9, "cvss_fn_weight": 34.8, "cvss_precision": 0.6233, "cvss_recall": 0.7874, "cvss_f3": 0.7672, "cvss_f3_score": 76.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 11, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.6296, "f1": 0.6182, "f2": 0.625, "f2_score": 62.5, "f3": 0.6273, "f3_score": 62.7, "tpr": 0.6296, "fpr": 0.7333, "youden_j": -0.1037, "cvss_coverage": 1.0, "cvss_tp_weight": 105.2, "cvss_fp_weight": 46.0, "cvss_fn_weight": 58.5, "cvss_precision": 0.6957, "cvss_recall": 0.6426, "cvss_f3": 0.6476, "cvss_f3_score": 64.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7857, "recall": 0.4074, "f1": 0.5366, "f2": 0.4508, "f2_score": 45.1, "f3": 0.428, "f3_score": 42.8, "tpr": 0.4074, "fpr": 0.4286, "youden_j": -0.0212, "cvss_coverage": 1.0, "cvss_tp_weight": 68.1, "cvss_fp_weight": 11.6, "cvss_fn_weight": 95.6, "cvss_precision": 0.8541, "cvss_recall": 0.416, "cvss_f3": 0.4385, "cvss_f3_score": 43.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 14, "fp": 3, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8235, "recall": 0.5185, "f1": 0.6364, "f2": 0.56, "f2_score": 56.0, "f3": 0.5385, "f3_score": 53.8, "tpr": 0.5185, "fpr": 0.4286, "youden_j": 0.0899, "cvss_coverage": 1.0, "cvss_tp_weight": 86.8, "cvss_fp_weight": 16.7, "cvss_fn_weight": 76.9, "cvss_precision": 0.8387, "cvss_recall": 0.5302, "cvss_f3": 0.5505, "cvss_f3_score": 55.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 8, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6923, "recall": 0.6667, "f1": 0.6792, "f2": 0.6716, "f2_score": 67.2, "f3": 0.6691, "f3_score": 66.9, "tpr": 0.6667, "fpr": 0.6667, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 109.4, "cvss_fp_weight": 44.5, "cvss_fn_weight": 54.3, "cvss_precision": 0.7108, "cvss_recall": 0.6683, "cvss_f3": 0.6723, "cvss_f3_score": 67.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-472" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 6, "fp": 1, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5963, "recall": 0.2099, "f1": 0.3103, "f2": 0.2411, "f2_score": 24.1, "f3": 0.2244, "f3_score": 22.4, "tpr": 0.2099, "fpr": 0.2, "youden_j": 0.0099, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 5.6, "cvss_fn_weight": 125.9, "cvss_precision": 0.607, "cvss_recall": 0.2309, "cvss_f3": 0.2462, "cvss_f3_score": 24.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/views.py", "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 6, "fp": 2, "fn": 21, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.2222, "f1": 0.3429, "f2": 0.2586, "f2_score": 25.9, "f3": 0.239, "f3_score": 23.9, "tpr": 0.2222, "fpr": 0.3333, "youden_j": -0.1111, "cvss_coverage": 1.0, "cvss_tp_weight": 40.6, "cvss_fp_weight": 11.1, "cvss_fn_weight": 123.1, "cvss_precision": 0.7849, "cvss_recall": 0.248, "cvss_f3": 0.2662, "cvss_f3_score": 26.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 }, "medium": { "tp": 2, "fp": 0, "fn": 12, "recall": 0.1429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 163.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 163.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 163.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 22, "fp": 17, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5641, "recall": 0.8148, "f1": 0.6667, "f2": 0.7483, "f2_score": 74.8, "f3": 0.7801, "f3_score": 78.0, "tpr": 0.8148, "fpr": 0.8095, "youden_j": 0.0053, "cvss_coverage": 1.0, "cvss_tp_weight": 133.5, "cvss_fp_weight": 74.3, "cvss_fn_weight": 30.2, "cvss_precision": 0.6423, "cvss_recall": 0.8155, "cvss_f3": 0.7941, "cvss_f3_score": 79.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/file.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 16, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6267, "recall": 0.5803, "f1": 0.6026, "f2": 0.589, "f2_score": 58.9, "f3": 0.5846, "f3_score": 58.5, "tpr": 0.5803, "fpr": 0.6947, "youden_j": -0.1144, "cvss_coverage": 1.0, "cvss_tp_weight": 101.5, "cvss_fp_weight": 45.2, "cvss_fn_weight": 62.2, "cvss_precision": 0.6918, "cvss_recall": 0.6202, "cvss_f3": 0.6266, "cvss_f3_score": 62.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 17, "fp": 3, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.85, "recall": 0.6296, "f1": 0.7234, "f2": 0.6641, "f2_score": 66.4, "f3": 0.6464, "f3_score": 64.6, "tpr": 0.6296, "fpr": 0.4286, "youden_j": 0.2011, "cvss_coverage": 1.0, "cvss_tp_weight": 104.6, "cvss_fp_weight": 16.7, "cvss_fn_weight": 59.1, "cvss_precision": 0.8624, "cvss_recall": 0.639, "cvss_f3": 0.656, "cvss_f3_score": 65.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 21, "fp": 24, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4667, "recall": 0.7778, "f1": 0.5833, "f2": 0.6863, "f2_score": 68.6, "f3": 0.7292, "f3_score": 72.9, "tpr": 0.7778, "fpr": 0.8571, "youden_j": -0.0794, "cvss_coverage": 1.0, "cvss_tp_weight": 135.4, "cvss_fp_weight": 123.4, "cvss_fn_weight": 28.3, "cvss_precision": 0.5231, "cvss_recall": 0.8271, "cvss_f3": 0.7817, "cvss_f3_score": 78.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 8, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.5185, "f1": 0.5714, "f2": 0.5385, "f2_score": 53.8, "f3": 0.5283, "f3_score": 52.8, "tpr": 0.5185, "fpr": 0.6667, "youden_j": -0.1481, "cvss_coverage": 1.0, "cvss_tp_weight": 90.9, "cvss_fp_weight": 39.5, "cvss_fn_weight": 72.8, "cvss_precision": 0.6973, "cvss_recall": 0.5553, "cvss_f3": 0.5668, "cvss_f3_score": 56.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 16, "fp": 14, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5333, "recall": 0.5926, "f1": 0.5614, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5861, "f3_score": 58.6, "tpr": 0.5926, "fpr": 0.7778, "youden_j": -0.1852, "cvss_coverage": 1.0, "cvss_tp_weight": 104.0, "cvss_fp_weight": 77.9, "cvss_fn_weight": 59.7, "cvss_precision": 0.5717, "cvss_recall": 0.6353, "cvss_f3": 0.6283, "cvss_f3_score": 62.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 }, "medium": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 27, "fp": 0, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 163.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-657", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8848, "recall": 0.4815, "f1": 0.6226, "f2": 0.5294, "f2_score": 53.0, "f3": 0.5043, "f3_score": 50.5, "tpr": 0.4815, "fpr": 0.2889, "youden_j": 0.1926, "cvss_coverage": 1.0, "cvss_tp_weight": 78.1, "cvss_fp_weight": 5.9, "cvss_fn_weight": 85.6, "cvss_precision": 0.9284, "cvss_recall": 0.4769, "cvss_f3": 0.5009, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 12, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7116, "recall": 0.4321, "f1": 0.5225, "f2": 0.4627, "f2_score": 46.3, "f3": 0.4467, "f3_score": 44.7, "tpr": 0.4321, "fpr": 0.4882, "youden_j": -0.0561, "cvss_coverage": 1.0, "cvss_tp_weight": 72.8, "cvss_fp_weight": 31.7, "cvss_fn_weight": 90.9, "cvss_precision": 0.7368, "cvss_recall": 0.4445, "cvss_f3": 0.4606, "cvss_f3_score": 46.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 16, "fp": 6, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7291, "recall": 0.5926, "f1": 0.6525, "f2": 0.6149, "f2_score": 61.5, "f3": 0.6035, "f3_score": 60.4, "tpr": 0.5926, "fpr": 0.596, "youden_j": -0.0034, "cvss_coverage": 1.0, "cvss_tp_weight": 101.8, "cvss_fp_weight": 28.4, "cvss_fn_weight": 61.8, "cvss_precision": 0.7845, "cvss_recall": 0.6221, "cvss_f3": 0.6349, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 18, "fp": 10, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6429, "recall": 0.6667, "f1": 0.6545, "f2": 0.6618, "f2_score": 66.2, "f3": 0.6642, "f3_score": 66.4, "tpr": 0.6667, "fpr": 0.7143, "youden_j": -0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 108.4, "cvss_fp_weight": 45.5, "cvss_fn_weight": 55.3, "cvss_precision": 0.7043, "cvss_recall": 0.6622, "cvss_f3": 0.6662, "cvss_f3_score": 66.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 5, "fp": 8, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3846, "recall": 0.1852, "f1": 0.25, "f2": 0.2066, "f2_score": 20.7, "f3": 0.1953, "f3_score": 19.5, "tpr": 0.1852, "fpr": 0.6667, "youden_j": -0.4815, "cvss_coverage": 1.0, "cvss_tp_weight": 34.1, "cvss_fp_weight": 26.5, "cvss_fn_weight": 129.6, "cvss_precision": 0.5627, "cvss_recall": 0.2083, "cvss_f3": 0.2223, "cvss_f3_score": 22.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/App.jsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 22, "fp": 96, "fn": 5, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1864, "recall": 0.8148, "f1": 0.3034, "f2": 0.4867, "f2_score": 48.7, "f3": 0.6094, "f3_score": 60.9, "tpr": 0.8148, "fpr": 0.96, "youden_j": -0.1452, "cvss_coverage": 1.0, "cvss_tp_weight": 138.5, "cvss_fp_weight": 599.5, "cvss_fn_weight": 25.2, "cvss_precision": 0.1877, "cvss_recall": 0.8461, "cvss_f3": 0.6263, "cvss_f3_score": 62.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-603" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit_service.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/dependencies.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/file.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-799" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/notifications.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/webhooks.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/vendor.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 18, "fp": 29, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.383, "recall": 0.6667, "f1": 0.4865, "f2": 0.5806, "f2_score": 58.1, "f3": 0.6207, "f3_score": 62.1, "tpr": 0.6667, "fpr": 0.8788, "youden_j": -0.2121, "cvss_coverage": 1.0, "cvss_tp_weight": 112.8, "cvss_fp_weight": 190.0, "cvss_fn_weight": 50.9, "cvss_precision": 0.3725, "cvss_recall": 0.6891, "cvss_f3": 0.6351, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/file.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 4, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.1111, "f1": 0.1765, "f2": 0.1304, "f2_score": 13.0, "f3": 0.12, "f3_score": 12.0, "tpr": 0.1111, "fpr": 0.5, "youden_j": -0.3889, "cvss_coverage": 1.0, "cvss_tp_weight": 20.2, "cvss_fp_weight": 28.5, "cvss_fn_weight": 143.5, "cvss_precision": 0.4148, "cvss_recall": 0.1234, "cvss_f3": 0.1327, "cvss_f3_score": 13.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/webhook.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/review.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 24, "fp": 72, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.8889, "f1": 0.3902, "f2": 0.5882, "f2_score": 58.8, "f3": 0.708, "f3_score": 70.8, "tpr": 0.8889, "fpr": 0.96, "youden_j": -0.0711, "cvss_coverage": 1.0, "cvss_tp_weight": 143.8, "cvss_fp_weight": 509.5, "cvss_fn_weight": 19.9, "cvss_precision": 0.2201, "cvss_recall": 0.8784, "cvss_f3": 0.6762, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.8235 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 13, "fp": 1, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/vendor.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/payout.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/product.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-266" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 23, "fp": 16, "fn": 4, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.5897, "recall": 0.8519, "f1": 0.697, "f2": 0.7823, "f2_score": 78.2, "f3": 0.8156, "f3_score": 81.6, "tpr": 0.8519, "fpr": 0.8421, "youden_j": 0.0097, "cvss_coverage": 1.0, "cvss_tp_weight": 141.5, "cvss_fp_weight": 123.0, "cvss_fn_weight": 22.2, "cvss_precision": 0.535, "cvss_recall": 0.8644, "cvss_f3": 0.8142, "cvss_f3_score": 81.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 1, "fn": 2, "recall": 0.8333 }, "medium": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "backend/app/api/files.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/vendor.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/webhook.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-657", "file": "backend/app/seller_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/Layout.jsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 16, "fp": 9, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.64, "recall": 0.5926, "f1": 0.6154, "f2": 0.6015, "f2_score": 60.2, "f3": 0.597, "f3_score": 59.7, "tpr": 0.5926, "fpr": 0.6923, "youden_j": -0.0997, "cvss_coverage": 1.0, "cvss_tp_weight": 99.0, "cvss_fp_weight": 53.0, "cvss_fn_weight": 64.7, "cvss_precision": 0.6513, "cvss_recall": 0.6048, "cvss_f3": 0.6091, "cvss_f3_score": 60.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/file.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 25, "fp": 121, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1712, "recall": 0.9259, "f1": 0.289, "f2": 0.4921, "f2_score": 49.2, "f3": 0.6427, "f3_score": 64.3, "tpr": 0.9259, "fpr": 0.9758, "youden_j": -0.0499, "cvss_coverage": 1.0, "cvss_tp_weight": 152.9, "cvss_fp_weight": 800.0, "cvss_fn_weight": 10.8, "cvss_precision": 0.1605, "cvss_recall": 0.934, "cvss_f3": 0.6302, "cvss_f3_score": 63.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 }, "medium": { "tp": 13, "fp": 1, "fn": 1, "recall": 0.9286 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": "backend/app/api/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/files.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/notifications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/notifications.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/webhooks.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models/vendor.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/auth.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/payout.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas/product.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-113", "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-114", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-144", "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-317", "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-667", "file": "backend/app/seller_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-687", "file": "backend/app/seller_operations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit_service.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.jsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-266" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 3, "fp": 10, "fn": 24, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1765, "recall": 0.1111, "f1": 0.1364, "f2": 0.12, "f2_score": 12.0, "f3": 0.1154, "f3_score": 11.5, "tpr": 0.1111, "fpr": 0.6994, "youden_j": -0.5882, "cvss_coverage": 1.0, "cvss_tp_weight": 19.0, "cvss_fp_weight": 48.7, "cvss_fn_weight": 144.7, "cvss_precision": 0.22, "cvss_recall": 0.1159, "cvss_f3": 0.1216, "cvss_f3_score": 12.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/seller_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/core/config.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 163.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 12, "fp": 6, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6667, "recall": 0.4444, "f1": 0.5333, "f2": 0.4762, "f2_score": 47.6, "f3": 0.4598, "f3_score": 46.0, "tpr": 0.4444, "fpr": 0.6, "youden_j": -0.1556, "cvss_coverage": 1.0, "cvss_tp_weight": 70.1, "cvss_fp_weight": 23.3, "cvss_fn_weight": 93.6, "cvss_precision": 0.7509, "cvss_recall": 0.4282, "cvss_f3": 0.4474, "cvss_f3_score": 44.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 }, "medium": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-724", "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-247", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-226", "file": "backend/app/seller_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-717", "file": "backend/app/seller_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-677", "file": "backend/app/seller_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/auth.py", "cwe": "CWE-539" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 6, "fp": 91, "fn": 21, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.0619, "recall": 0.2222, "f1": 0.0968, "f2": 0.1463, "f2_score": 14.6, "f3": 0.1765, "f3_score": 17.6, "tpr": 0.2222, "fpr": 0.9681, "youden_j": -0.7459, "cvss_coverage": 1.0, "cvss_tp_weight": 36.6, "cvss_fp_weight": 198.5, "cvss_fn_weight": 127.1, "cvss_precision": 0.1557, "cvss_recall": 0.2236, "cvss_f3": 0.2142, "cvss_f3_score": 21.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 2, "fp": 1, "fn": 10, "recall": 0.1667 }, "medium": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": "backend/app/api/files.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-332", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-737", "file": "backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/api_keys.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": "backend/app/api/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": "backend/app/api/payouts.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/products.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/reviews.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/vendors.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/webhooks.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/webhooks.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/core/security.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminDashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminDashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminDashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminDashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AuditLogs.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AuditLogs.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Cart.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Dashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Dashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Dashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Dashboard.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/DisputeDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Disputes.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Disputes.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Exports.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Exports.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Imports.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Moderation.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Moderation.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Moderation.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Notifications.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Notifications.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Notifications.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Orders.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Orders.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Orders.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Payouts.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Payouts.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Payouts.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductDetail.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/ProductManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Profile.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Reviews.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Reviews.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Reviews.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Settings.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Storefront.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Storefront.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Storefront.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/UserManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/UserManagement.jsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/VendorDashboard.jsx", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 3, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.4286, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 11.6, "cvss_fn_weight": 163.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/backend/app/seller_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-marketplace-commerce-fastapi/backend/app/seller_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-112", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-284", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-697", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-707", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 5, "fp": 33, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1316, "recall": 0.1852, "f1": 0.1538, "f2": 0.1712, "f2_score": 17.1, "f3": 0.1779, "f3_score": 17.8, "tpr": 0.1852, "fpr": 0.8919, "youden_j": -0.7067, "cvss_coverage": 1.0, "cvss_tp_weight": 26.7, "cvss_fp_weight": 191.5, "cvss_fn_weight": 137.0, "cvss_precision": 0.1224, "cvss_recall": 0.1631, "cvss_f3": 0.1578, "cvss_f3_score": 15.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 11, "recall": 0.0833 }, "medium": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-002", "file": "backend/app/api/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/disputes.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/orders.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/api/payouts.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-112", "file": "backend/app/seller_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-284", "file": "backend/app/seller_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-697", "file": "backend/app/seller_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seller_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-707", "file": "backend/app/seller_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/contexts/AuthContext.jsx", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-113", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-114", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-144", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-226", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-247", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-317", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-332", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-657", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-667", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-677", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-687", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-717", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-724", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-737", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-002", "file": null, "cwe": "CWE-328" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-003", "file": null, "cwe": "CWE-89" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-fp-004", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-005", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-006", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-007", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-008", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi-enrich-009", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-property-management-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 24, "fp": 8, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.75, "recall": 0.8, "f1": 0.7742, "f2": 0.7895, "f2_score": 78.9, "f3": 0.7947, "f3_score": 79.5, "tpr": 0.8, "fpr": 0.6667, "youden_j": 0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 155.6, "cvss_fp_weight": 40.8, "cvss_fn_weight": 31.5, "cvss_precision": 0.7921, "cvss_recall": 0.8316, "cvss_f3": 0.8275, "cvss_f3_score": 82.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 5, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7727, "recall": 0.5667, "f1": 0.6538, "f2": 0.5986, "f2_score": 59.9, "f3": 0.5822, "f3_score": 58.2, "tpr": 0.5667, "fpr": 0.5556, "youden_j": 0.0111, "cvss_coverage": 1.0, "cvss_tp_weight": 109.2, "cvss_fp_weight": 13.0, "cvss_fn_weight": 77.9, "cvss_precision": 0.8934, "cvss_recall": 0.5836, "cvss_f3": 0.6046, "cvss_f3_score": 60.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-208" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 2, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8889, "recall": 0.5333, "f1": 0.6667, "f2": 0.5797, "f2_score": 58.0, "f3": 0.5556, "f3_score": 55.6, "tpr": 0.5333, "fpr": 0.3333, "youden_j": 0.2, "cvss_coverage": 1.0, "cvss_tp_weight": 102.7, "cvss_fp_weight": 11.5, "cvss_fn_weight": 84.4, "cvss_precision": 0.8991, "cvss_recall": 0.5489, "cvss_f3": 0.5712, "cvss_f3_score": 57.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 15, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8333, "recall": 0.5, "f1": 0.625, "f2": 0.5435, "f2_score": 54.3, "f3": 0.5208, "f3_score": 52.1, "tpr": 0.5, "fpr": 0.4286, "youden_j": 0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 101.5, "cvss_fp_weight": 17.3, "cvss_fn_weight": 85.6, "cvss_precision": 0.8545, "cvss_recall": 0.5425, "cvss_f3": 0.563, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 24, "fp": 11, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6857, "recall": 0.8, "f1": 0.7385, "f2": 0.7742, "f2_score": 77.4, "f3": 0.7869, "f3_score": 78.7, "tpr": 0.8, "fpr": 0.7333, "youden_j": 0.0667, "cvss_coverage": 1.0, "cvss_tp_weight": 155.6, "cvss_fp_weight": 63.4, "cvss_fn_weight": 31.5, "cvss_precision": 0.7106, "cvss_recall": 0.8316, "cvss_f3": 0.8177, "cvss_f3_score": 81.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 3, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7692, "recall": 0.3333, "f1": 0.4651, "f2": 0.3759, "f2_score": 37.6, "f3": 0.3534, "f3_score": 35.3, "tpr": 0.3333, "fpr": 0.4286, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 70.1, "cvss_fp_weight": 17.3, "cvss_fn_weight": 117.0, "cvss_precision": 0.8022, "cvss_recall": 0.3747, "cvss_f3": 0.3958, "cvss_f3_score": 39.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 2, "fp": 0, "fn": 11, "recall": 0.1538 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 0, "fp": 0, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 187.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-358", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 14, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8867, "recall": 0.4667, "f1": 0.6088, "f2": 0.5144, "f2_score": 51.4, "f3": 0.4894, "f3_score": 48.9, "tpr": 0.4667, "fpr": 0.3, "youden_j": 0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 91.5, "cvss_fp_weight": 9.8, "cvss_fn_weight": 95.6, "cvss_precision": 0.9097, "cvss_recall": 0.4892, "cvss_f3": 0.5127, "cvss_f3_score": 51.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 1, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 16, "fp": 5, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7754, "recall": 0.5333, "f1": 0.6314, "f2": 0.5686, "f2_score": 56.9, "f3": 0.5504, "f3_score": 55.0, "tpr": 0.5333, "fpr": 0.5333, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 103.6, "cvss_fp_weight": 19.8, "cvss_fn_weight": 83.5, "cvss_precision": 0.8389, "cvss_recall": 0.5537, "cvss_f3": 0.5732, "cvss_f3_score": 57.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 20, "fp": 12, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6249, "recall": 0.6667, "f1": 0.6445, "f2": 0.6574, "f2_score": 65.8, "f3": 0.662, "f3_score": 66.2, "tpr": 0.6667, "fpr": 0.7369, "youden_j": -0.0702, "cvss_coverage": 1.0, "cvss_tp_weight": 126.2, "cvss_fp_weight": 57.0, "cvss_fn_weight": 60.9, "cvss_precision": 0.6917, "cvss_recall": 0.6745, "cvss_f3": 0.6761, "cvss_f3_score": 67.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 6, "fp": 0, "fn": 7, "recall": 0.4615 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 24, "fn": 7, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4894, "recall": 0.7667, "f1": 0.5974, "f2": 0.6886, "f2_score": 68.9, "f3": 0.7256, "f3_score": 72.6, "tpr": 0.7667, "fpr": 0.8571, "youden_j": -0.0905, "cvss_coverage": 1.0, "cvss_tp_weight": 147.5, "cvss_fp_weight": 133.0, "cvss_fn_weight": 39.6, "cvss_precision": 0.5258, "cvss_recall": 0.7883, "cvss_f3": 0.7509, "cvss_f3_score": 75.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 20, "fp": 13, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.609, "recall": 0.6555, "f1": 0.6312, "f2": 0.6455, "f2_score": 64.6, "f3": 0.6505, "f3_score": 65.0, "tpr": 0.6555, "fpr": 0.7562, "youden_j": -0.1006, "cvss_coverage": 1.0, "cvss_tp_weight": 127.7, "cvss_fp_weight": 64.2, "cvss_fn_weight": 59.4, "cvss_precision": 0.666, "cvss_recall": 0.6827, "cvss_f3": 0.6809, "cvss_f3_score": 68.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-266" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 3, "fp": 4, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.1, "f1": 0.1622, "f2": 0.1181, "f2_score": 11.8, "f3": 0.1083, "f3_score": 10.8, "tpr": 0.1, "fpr": 0.5, "youden_j": -0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 20.4, "cvss_fp_weight": 23.0, "cvss_fn_weight": 166.7, "cvss_precision": 0.4695, "cvss_recall": 0.109, "cvss_f3": 0.1181, "cvss_f3_score": 11.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.0625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-358", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 26, "fp": 33, "fn": 4, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4407, "recall": 0.8667, "f1": 0.5843, "f2": 0.7263, "f2_score": 72.6, "f3": 0.7903, "f3_score": 79.0, "tpr": 0.8667, "fpr": 0.8919, "youden_j": -0.0252, "cvss_coverage": 1.0, "cvss_tp_weight": 165.0, "cvss_fp_weight": 179.6, "cvss_fn_weight": 22.1, "cvss_precision": 0.4788, "cvss_recall": 0.8819, "cvss_f3": 0.8134, "cvss_f3_score": 81.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.75 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 10, "fp": 0, "fn": 3, "recall": 0.7692 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 18, "fp": 5, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7826, "recall": 0.6, "f1": 0.6792, "f2": 0.6294, "f2_score": 62.9, "f3": 0.6143, "f3_score": 61.4, "tpr": 0.6, "fpr": 0.5556, "youden_j": 0.0444, "cvss_coverage": 1.0, "cvss_tp_weight": 121.2, "cvss_fp_weight": 28.8, "cvss_fn_weight": 65.9, "cvss_precision": 0.808, "cvss_recall": 0.6478, "cvss_f3": 0.6609, "cvss_f3_score": 66.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 4, "fp": 0, "fn": 9, "recall": 0.3077 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 19, "fp": 19, "fn": 11, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.6333, "f1": 0.5588, "f2": 0.6013, "f2_score": 60.1, "f3": 0.6169, "f3_score": 61.7, "tpr": 0.6333, "fpr": 0.8261, "youden_j": -0.1928, "cvss_coverage": 1.0, "cvss_tp_weight": 125.1, "cvss_fp_weight": 109.5, "cvss_fn_weight": 62.0, "cvss_precision": 0.5333, "cvss_recall": 0.6686, "cvss_f3": 0.6521, "cvss_f3_score": 65.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-789" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 24, "fp": 18, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5714, "recall": 0.8, "f1": 0.6667, "f2": 0.7407, "f2_score": 74.1, "f3": 0.7692, "f3_score": 76.9, "tpr": 0.8, "fpr": 0.8182, "youden_j": -0.0182, "cvss_coverage": 1.0, "cvss_tp_weight": 155.6, "cvss_fp_weight": 103.7, "cvss_fn_weight": 31.5, "cvss_precision": 0.6, "cvss_recall": 0.8316, "cvss_f3": 0.8007, "cvss_f3_score": 80.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.6875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 14, "fp": 2, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8576, "recall": 0.4667, "f1": 0.6029, "f2": 0.5129, "f2_score": 51.3, "f3": 0.4886, "f3_score": 48.9, "tpr": 0.4667, "fpr": 0.3651, "youden_j": 0.1016, "cvss_coverage": 1.0, "cvss_tp_weight": 91.4, "cvss_fp_weight": 11.7, "cvss_fn_weight": 95.7, "cvss_precision": 0.8859, "cvss_recall": 0.4885, "cvss_f3": 0.5112, "cvss_f3_score": 51.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 14, "fp": 10, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5833, "recall": 0.4667, "f1": 0.5185, "f2": 0.4861, "f2_score": 48.6, "f3": 0.4762, "f3_score": 47.6, "tpr": 0.4667, "fpr": 0.7143, "youden_j": -0.2476, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 47.1, "cvss_fn_weight": 91.9, "cvss_precision": 0.669, "cvss_recall": 0.5088, "cvss_f3": 0.5213, "cvss_f3_score": 52.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 5, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6532, "recall": 0.3889, "f1": 0.4809, "f2": 0.4205, "f2_score": 42.0, "f3": 0.404, "f3_score": 40.4, "tpr": 0.3889, "fpr": 0.5667, "youden_j": -0.1778, "cvss_coverage": 1.0, "cvss_tp_weight": 78.6, "cvss_fp_weight": 25.4, "cvss_fn_weight": 108.5, "cvss_precision": 0.7198, "cvss_recall": 0.4199, "cvss_f3": 0.4366, "cvss_f3_score": 43.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 21, "fp": 5, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8077, "recall": 0.7, "f1": 0.75, "f2": 0.7192, "f2_score": 71.9, "f3": 0.7095, "f3_score": 70.9, "tpr": 0.7, "fpr": 0.5556, "youden_j": 0.1444, "cvss_coverage": 1.0, "cvss_tp_weight": 137.8, "cvss_fp_weight": 23.5, "cvss_fn_weight": 49.3, "cvss_precision": 0.8541, "cvss_recall": 0.7365, "cvss_f3": 0.7468, "cvss_f3_score": 74.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 0, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 19, "fp": 11, "fn": 11, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6333, "recall": 0.6333, "f1": 0.6333, "f2": 0.6333, "f2_score": 63.3, "f3": 0.6333, "f3_score": 63.3, "tpr": 0.6333, "fpr": 0.7857, "youden_j": -0.1524, "cvss_coverage": 1.0, "cvss_tp_weight": 122.0, "cvss_fp_weight": 82.0, "cvss_fn_weight": 65.1, "cvss_precision": 0.598, "cvss_recall": 0.6521, "cvss_f3": 0.6462, "cvss_f3_score": 64.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 7, "fp": 1, "fn": 6, "recall": 0.5385 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 28, "fp": 86, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2456, "recall": 0.9333, "f1": 0.3889, "f2": 0.5983, "f2_score": 59.8, "f3": 0.7292, "f3_score": 72.9, "tpr": 0.9333, "fpr": 0.9556, "youden_j": -0.0222, "cvss_coverage": 1.0, "cvss_tp_weight": 176.3, "cvss_fp_weight": 542.5, "cvss_fn_weight": 10.8, "cvss_precision": 0.2453, "cvss_recall": 0.9423, "cvss_f3": 0.7338, "cvss_f3_score": 73.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/api.js", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "env.example", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/notifications.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 18, "fp": 55, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2466, "recall": 0.6, "f1": 0.3495, "f2": 0.4663, "f2_score": 46.6, "f3": 0.5248, "f3_score": 52.5, "tpr": 0.6, "fpr": 0.9322, "youden_j": -0.3322, "cvss_coverage": 1.0, "cvss_tp_weight": 120.0, "cvss_fp_weight": 380.5, "cvss_fn_weight": 67.1, "cvss_precision": 0.2398, "cvss_recall": 0.6414, "cvss_f3": 0.5493, "cvss_f3_score": 54.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-281" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 3, "fp": 2, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6, "recall": 0.1, "f1": 0.1714, "f2": 0.12, "f2_score": 12.0, "f3": 0.1091, "f3_score": 10.9, "tpr": 0.1, "fpr": 0.3333, "youden_j": -0.2333, "cvss_coverage": 1.0, "cvss_tp_weight": 21.8, "cvss_fp_weight": 16.0, "cvss_fn_weight": 165.3, "cvss_precision": 0.5767, "cvss_recall": 0.1165, "cvss_f3": 0.1266, "cvss_f3_score": 12.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 3, "fp": 0, "fn": 11, "recall": 0.2143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 28, "fp": 87, "fn": 2, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2435, "recall": 0.9333, "f1": 0.3862, "f2": 0.5957, "f2_score": 59.6, "f3": 0.7273, "f3_score": 72.7, "tpr": 0.9333, "fpr": 0.9667, "youden_j": -0.0333, "cvss_coverage": 1.0, "cvss_tp_weight": 171.5, "cvss_fp_weight": 617.0, "cvss_fn_weight": 15.6, "cvss_precision": 0.2175, "cvss_recall": 0.9166, "cvss_f3": 0.6937, "cvss_f3_score": 69.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 1, "fn": 2, "recall": 0.8571 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/integrations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-658", "file": "backend/app/tenant_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Payments.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Properties.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TenantDashboard.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/WorkerDashboard.jsx", "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 28, "fp": 12, "fn": 2, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.9333, "f1": 0.8, "f2": 0.875, "f2_score": 87.5, "f3": 0.9032, "f3_score": 90.3, "tpr": 0.9333, "fpr": 0.75, "youden_j": 0.1833, "cvss_coverage": 1.0, "cvss_tp_weight": 176.0, "cvss_fp_weight": 83.5, "cvss_fn_weight": 11.1, "cvss_precision": 0.6782, "cvss_recall": 0.9407, "cvss_f3": 0.9056, "cvss_f3_score": 90.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9375 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 1, "recall": 0.9231 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-658", "file": "backend/app/tenant_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": "backend/app/routers/maintenance.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/MaintenanceTickets.jsx", "cwe": "CWE-601" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 21, "fp": 16, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5676, "recall": 0.7, "f1": 0.6269, "f2": 0.6688, "f2_score": 66.9, "f3": 0.684, "f3_score": 68.4, "tpr": 0.7, "fpr": 0.8, "youden_j": -0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 133.8, "cvss_fp_weight": 106.5, "cvss_fn_weight": 53.3, "cvss_precision": 0.5568, "cvss_recall": 0.7151, "cvss_f3": 0.6954, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5625 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 8, "fp": 0, "fn": 5, "recall": 0.6154 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 29, "fp": 128, "fn": 1, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.1847, "recall": 0.9667, "f1": 0.3102, "f2": 0.5235, "f2_score": 52.3, "f3": 0.6792, "f3_score": 67.9, "tpr": 0.9667, "fpr": 0.9771, "youden_j": -0.0104, "cvss_coverage": 1.0, "cvss_tp_weight": 180.6, "cvss_fp_weight": 871.0, "cvss_fn_weight": 6.5, "cvss_precision": 0.1717, "cvss_recall": 0.9653, "cvss_f3": 0.6602, "cvss_f3_score": 66.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 16, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 1, "fn": 1, "recall": 0.9286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 13, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/integrations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": "backend/app/routers/auth.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": "backend/app/routers/auth.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/exports.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/imports.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/inspections.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/integrations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/leases.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/maintenance.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/payments.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/properties.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/schemas.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/audit_service.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": "backend/app/services/file_service.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-205", "file": "backend/app/tenant_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-658", "file": "backend/app/tenant_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-668", "file": "backend/app/tenant_operations.py", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-688", "file": "backend/app/tenant_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/utils/permissions.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Messages.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Payments.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Properties.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Register.jsx", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/TenantDashboard.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/WorkerDashboard.jsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/vite.config.js", "cwe": "CWE-319" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 0, "fp": 19, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.8226, "youden_j": -0.8226, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 97.0, "cvss_fn_weight": 187.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "app/tenant_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/services/file_service.py", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-358", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 0, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 187.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-358", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 14, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.4667, "f1": 0.56, "f2": 0.5, "f2_score": 50.0, "f3": 0.4828, "f3_score": 48.3, "tpr": 0.4667, "fpr": 0.6, "youden_j": -0.1333, "cvss_coverage": 1.0, "cvss_tp_weight": 90.8, "cvss_fp_weight": 18.8, "cvss_fn_weight": 96.3, "cvss_precision": 0.8286, "cvss_recall": 0.4853, "cvss_f3": 0.5063, "cvss_f3_score": 50.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3125 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "low": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 5, "fp": 0, "fn": 8, "recall": 0.3846 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-725", "file": "backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-248", "file": "backend/app/tenant_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-115", "file": "backend/app/tenant_operations.py", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-116", "file": "backend/app/tenant_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/messages.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/routers/users.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-644" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-318", "file": "backend/app/tenant_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-718", "file": "backend/app/tenant_operations.py", "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 10, "fn": 22, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.2667, "f1": 0.3333, "f2": 0.2899, "f2_score": 29.0, "f3": 0.2778, "f3_score": 27.8, "tpr": 0.2667, "fpr": 0.7692, "youden_j": -0.5026, "cvss_coverage": 1.0, "cvss_tp_weight": 54.4, "cvss_fp_weight": 70.5, "cvss_fn_weight": 132.7, "cvss_precision": 0.4355, "cvss_recall": 0.2908, "cvss_f3": 0.3008, "cvss_f3_score": 30.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 1, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 11, "recall": 0.2143 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-678", "file": "backend/app/tenant_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": "backend/app/routers/documents.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-738", "file": "backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": "backend/app/routers/auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 9, "fn": 30, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.6923, "youden_j": -0.6923, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 46.6, "cvss_fn_weight": 187.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 16, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 13, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/backend/app/tenant_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-property-management-fastapi/docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-117", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-183", "file": null, "cwe": "CWE-502" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-285", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-358", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-698", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-708", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 8, "fp": 5, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6154, "recall": 0.2667, "f1": 0.3721, "f2": 0.3008, "f2_score": 30.1, "f3": 0.2827, "f3_score": 28.3, "tpr": 0.2667, "fpr": 0.5556, "youden_j": -0.2889, "cvss_coverage": 1.0, "cvss_tp_weight": 48.3, "cvss_fp_weight": 36.3, "cvss_fn_weight": 138.8, "cvss_precision": 0.571, "cvss_recall": 0.2582, "cvss_f3": 0.2731, "cvss_f3_score": 27.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "insecure_deserialization": { "label": "Insecure Deserialization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1875 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 }, "low": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "medium": { "tp": 3, "fp": 0, "fn": 10, "recall": 0.2308 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-001", "file": "backend/app/config.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-002", "file": "backend/app/routers/auth.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-117", "file": "backend/app/tenant_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-183", "file": "backend/app/tenant_operations.py", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-285", "file": "backend/app/tenant_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-358", "file": "backend/app/tenant_operations.py", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-698", "file": "backend/app/tenant_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/tenant_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-708", "file": "backend/app/tenant_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-115", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-116", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-205", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-248", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-318", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-658", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-668", "file": null, "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-678", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-688", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-718", "file": null, "cwe": "CWE-943" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-725", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-738", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-002", "file": null, "cwe": "CWE-22" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-003", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-fp-004", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-005", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-006", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-009", "file": null, "cwe": "CWE-269" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-010", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-011", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-property-management-fastapi-enrich-012", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v2-support-desk-fastapi": { "claude-opus-5-cc-agentic-v1": { "scanner": "claude-opus-5-cc-agentic-v1", "tp": 20, "fp": 8, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7143, "recall": 0.7143, "f1": 0.7143, "f2": 0.7143, "f2_score": 71.4, "f3": 0.7143, "f3_score": 71.4, "tpr": 0.7143, "fpr": 0.6667, "youden_j": 0.0476, "cvss_coverage": 1.0, "cvss_tp_weight": 116.8, "cvss_fp_weight": 33.4, "cvss_fn_weight": 47.2, "cvss_precision": 0.7776, "cvss_recall": 0.7122, "cvss_f3": 0.7182, "cvss_f3_score": 71.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" } ] }, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 7, "fn": 12, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6957, "recall": 0.5714, "f1": 0.6275, "f2": 0.5926, "f2_score": 59.3, "f3": 0.5818, "f3_score": 58.2, "tpr": 0.5714, "fpr": 0.6364, "youden_j": -0.0649, "cvss_coverage": 1.0, "cvss_tp_weight": 99.7, "cvss_fp_weight": 18.2, "cvss_fn_weight": 64.3, "cvss_precision": 0.8456, "cvss_recall": 0.6079, "cvss_f3": 0.6255, "cvss_f3_score": 62.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 3, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8, "recall": 0.4286, "f1": 0.5581, "f2": 0.4724, "f2_score": 47.2, "f3": 0.4494, "f3_score": 44.9, "tpr": 0.4286, "fpr": 0.4286, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 75.6, "cvss_fp_weight": 6.4, "cvss_fn_weight": 88.4, "cvss_precision": 0.922, "cvss_recall": 0.461, "cvss_f3": 0.4852, "cvss_f3_score": 48.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 6, "fp": 0, "fn": 8, "recall": 0.4286 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 13, "fp": 3, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8125, "recall": 0.4643, "f1": 0.5909, "f2": 0.5078, "f2_score": 50.8, "f3": 0.4851, "f3_score": 48.5, "tpr": 0.4643, "fpr": 0.4286, "youden_j": 0.0357, "cvss_coverage": 1.0, "cvss_tp_weight": 83.6, "cvss_fp_weight": 16.2, "cvss_fn_weight": 80.4, "cvss_precision": 0.8377, "cvss_recall": 0.5098, "cvss_f3": 0.5305, "cvss_f3_score": 53.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 7, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.72, "recall": 0.6429, "f1": 0.6792, "f2": 0.6569, "f2_score": 65.7, "f3": 0.6498, "f3_score": 65.0, "tpr": 0.6429, "fpr": 0.6364, "youden_j": 0.0065, "cvss_coverage": 1.0, "cvss_tp_weight": 105.5, "cvss_fp_weight": 28.0, "cvss_fn_weight": 58.5, "cvss_precision": 0.7903, "cvss_recall": 0.6433, "cvss_f3": 0.6555, "cvss_f3_score": 65.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" } ] }, "gemini-3.5-flash-agentic-v1": { "scanner": "gemini-3.5-flash-agentic-v1", "tp": 10, "fp": 0, "fn": 18, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.375, "f1": 0.5452, "f2": 0.4285, "f2_score": 42.9, "f3": 0.4, "f3_score": 40.0, "tpr": 0.375, "fpr": 0.0, "youden_j": 0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 66.3, "cvss_fp_weight": 0.0, "cvss_fn_weight": 97.7, "cvss_precision": 1.0, "cvss_recall": 0.4045, "cvss_f3": 0.4301, "cvss_f3_score": 43.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "gemma4-31b-agentic-v1": { "scanner": "gemma4-31b-agentic-v1", "tp": 8, "fp": 0, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 0.2857, "f1": 0.4444, "f2": 0.3333, "f2_score": 33.3, "f3": 0.3077, "f3_score": 30.8, "tpr": 0.2857, "fpr": 0.0, "youden_j": 0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 53.2, "cvss_fp_weight": 0.0, "cvss_fn_weight": 110.8, "cvss_precision": 1.0, "cvss_recall": 0.3244, "cvss_f3": 0.3479, "cvss_f3_score": 34.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 }, "medium": { "tp": 2, "fp": 0, "fn": 10, "recall": 0.1667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "glm-5-agentic-v1": { "scanner": "glm-5-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 164.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "glm-5.1-agentic-v1": { "scanner": "glm-5.1-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 164.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "glm-5.2-agentic-v1": { "scanner": "glm-5.2-agentic-v1", "tp": 0, "fp": 0, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 164.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 12, "fn": 9, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6129, "recall": 0.6786, "f1": 0.6441, "f2": 0.6643, "f2_score": 66.4, "f3": 0.6714, "f3_score": 67.1, "tpr": 0.6786, "fpr": 0.75, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 113.0, "cvss_fp_weight": 45.2, "cvss_fn_weight": 51.0, "cvss_precision": 0.7143, "cvss_recall": 0.689, "cvss_f3": 0.6915, "cvss_f3_score": 69.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5882 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": { "scanner": "gpt-5.5-agentic-v1", "tp": 18, "fp": 13, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5862, "recall": 0.6548, "f1": 0.6177, "f2": 0.6392, "f2_score": 63.9, "f3": 0.6468, "f3_score": 64.7, "tpr": 0.6548, "fpr": 0.763, "youden_j": -0.1082, "cvss_coverage": 1.0, "cvss_tp_weight": 113.2, "cvss_fp_weight": 55.5, "cvss_fn_weight": 50.8, "cvss_precision": 0.6726, "cvss_recall": 0.69, "cvss_f3": 0.6879, "cvss_f3_score": 68.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-luna-codex-cli": { "scanner": "gpt-5.6-luna-codex-cli", "tp": 13, "fp": 2, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.8667, "recall": 0.4643, "f1": 0.6047, "f2": 0.5118, "f2_score": 51.2, "f3": 0.4869, "f3_score": 48.7, "tpr": 0.4643, "fpr": 0.3333, "youden_j": 0.131, "cvss_coverage": 1.0, "cvss_tp_weight": 82.6, "cvss_fp_weight": 10.8, "cvss_fn_weight": 81.4, "cvss_precision": 0.8844, "cvss_recall": 0.5037, "cvss_f3": 0.5263, "cvss_f3_score": 52.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2941 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 28, "fp": 12, "fn": 0, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 1.0, "f1": 0.8235, "f2": 0.9211, "f2_score": 92.1, "f3": 0.9589, "f3_score": 95.9, "tpr": 1.0, "fpr": 0.75, "youden_j": 0.25, "cvss_coverage": 1.0, "cvss_tp_weight": 164.0, "cvss_fp_weight": 55.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.7489, "cvss_recall": 1.0, "cvss_f3": 0.9676, "cvss_f3_score": 96.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 14, "fp": 0, "fn": 0, "recall": 1.0 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-119", "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-659", "file": "backend/app/support_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "gpt-5.6-terra-codex-cli": { "scanner": "gpt-5.6-terra-codex-cli", "tp": 14, "fp": 8, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6364, "recall": 0.5, "f1": 0.56, "f2": 0.5224, "f2_score": 52.2, "f3": 0.5109, "f3_score": 51.1, "tpr": 0.5, "fpr": 0.6667, "youden_j": -0.1667, "cvss_coverage": 1.0, "cvss_tp_weight": 86.5, "cvss_fp_weight": 43.2, "cvss_fn_weight": 77.5, "cvss_precision": 0.6669, "cvss_recall": 0.5274, "cvss_f3": 0.5387, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 8, "fp": 0, "fn": 6, "recall": 0.5714 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 18, "fp": 15, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5455, "recall": 0.6429, "f1": 0.5902, "f2": 0.6207, "f2_score": 62.1, "f3": 0.6316, "f3_score": 63.2, "tpr": 0.6429, "fpr": 0.7895, "youden_j": -0.1466, "cvss_coverage": 1.0, "cvss_tp_weight": 110.8, "cvss_fp_weight": 71.2, "cvss_fn_weight": 53.2, "cvss_precision": 0.6088, "cvss_recall": 0.6756, "cvss_f3": 0.6683, "cvss_f3_score": 66.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4706 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_sla.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 22, "fp": 16, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5789, "recall": 0.7857, "f1": 0.6667, "f2": 0.7333, "f2_score": 73.3, "f3": 0.7586, "f3_score": 75.9, "tpr": 0.7857, "fpr": 0.8, "youden_j": -0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 133.5, "cvss_fp_weight": 81.5, "cvss_fn_weight": 30.5, "cvss_precision": 0.6209, "cvss_recall": 0.814, "cvss_f3": 0.7895, "cvss_f3_score": 78.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 0, "fn": 2, "recall": 0.8571 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-659", "file": "backend/app/support_operations.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" } ] }, "kimi-k2.5-agentic-v1": { "scanner": "kimi-k2.5-agentic-v1", "tp": 13, "fp": 7, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7053, "recall": 0.4524, "f1": 0.5396, "f2": 0.4819, "f2_score": 48.2, "f3": 0.4664, "f3_score": 46.6, "tpr": 0.4524, "fpr": 0.5171, "youden_j": -0.0647, "cvss_coverage": 1.0, "cvss_tp_weight": 73.2, "cvss_fp_weight": 31.1, "cvss_fn_weight": 90.8, "cvss_precision": 0.7576, "cvss_recall": 0.4465, "cvss_f3": 0.4632, "cvss_f3_score": 46.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 4, "fp": 0, "fn": 10, "recall": 0.2857 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.6-agentic-v1": { "scanner": "kimi-k2.6-agentic-v1", "tp": 13, "fp": 12, "fn": 15, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.52, "recall": 0.4643, "f1": 0.4906, "f2": 0.4745, "f2_score": 47.4, "f3": 0.4693, "f3_score": 46.9, "tpr": 0.4643, "fpr": 0.75, "youden_j": -0.2857, "cvss_coverage": 1.0, "cvss_tp_weight": 79.3, "cvss_fp_weight": 45.2, "cvss_fn_weight": 84.7, "cvss_precision": 0.6369, "cvss_recall": 0.4835, "cvss_f3": 0.4955, "cvss_f3_score": 49.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "medium": { "tp": 6, "fp": 0, "fn": 6, "recall": 0.5 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kimi-k2.7-agentic-v1": { "scanner": "kimi-k2.7-agentic-v1", "tp": 12, "fp": 6, "fn": 16, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.6788, "recall": 0.4286, "f1": 0.5217, "f2": 0.4611, "f2_score": 46.1, "f3": 0.4442, "f3_score": 44.4, "tpr": 0.4286, "fpr": 0.5772, "youden_j": -0.1486, "cvss_coverage": 1.0, "cvss_tp_weight": 74.3, "cvss_fp_weight": 19.3, "cvss_fn_weight": 89.7, "cvss_precision": 0.8045, "cvss_recall": 0.453, "cvss_f3": 0.4732, "cvss_f3_score": 47.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.3529 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 5, "fp": 0, "fn": 9, "recall": 0.3571 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kimi-k3-agentic-v1": { "scanner": "kimi-k3-agentic-v1", "tp": 20, "fp": 7, "fn": 8, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7407, "recall": 0.7143, "f1": 0.7273, "f2": 0.7194, "f2_score": 71.9, "f3": 0.7168, "f3_score": 71.7, "tpr": 0.7143, "fpr": 0.6364, "youden_j": 0.0779, "cvss_coverage": 1.0, "cvss_tp_weight": 117.6, "cvss_fp_weight": 13.3, "cvss_fn_weight": 46.4, "cvss_precision": 0.8984, "cvss_recall": 0.7171, "cvss_f3": 0.7318, "cvss_f3_score": 73.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6471 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "medium": { "tp": 8, "fp": 0, "fn": 4, "recall": 0.6667 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kolega-ca-cc-sonnet": { "scanner": "kolega-ca-cc-sonnet", "tp": 15, "fp": 1, "fn": 13, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.9375, "recall": 0.5357, "f1": 0.6818, "f2": 0.5859, "f2_score": 58.6, "f3": 0.5597, "f3_score": 56.0, "tpr": 0.5357, "fpr": 0.2, "youden_j": 0.3357, "cvss_coverage": 1.0, "cvss_tp_weight": 98.8, "cvss_fp_weight": 5.5, "cvss_fn_weight": 65.2, "cvss_precision": 0.9473, "cvss_recall": 0.6024, "cvss_f3": 0.6252, "cvss_f3_score": 62.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kolega-claude-adaptation": { "scanner": "kolega-claude-adaptation", "tp": 25, "fp": 62, "fn": 3, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.2874, "recall": 0.8929, "f1": 0.4348, "f2": 0.6281, "f2_score": 62.8, "f3": 0.7375, "f3_score": 73.7, "tpr": 0.8929, "fpr": 0.9538, "youden_j": -0.061, "cvss_coverage": 1.0, "cvss_tp_weight": 146.7, "cvss_fp_weight": 422.5, "cvss_fn_weight": 17.3, "cvss_precision": 0.2577, "cvss_recall": 0.8945, "cvss_f3": 0.7173, "cvss_f3_score": 71.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 1, "fn": 1, "precision": 0.5, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.8824 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 12, "fp": 1, "fn": 2, "recall": 0.8571 }, "medium": { "tp": 11, "fp": 0, "fn": 1, "recall": 0.9167 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-119", "file": "backend/app/support_operations.py", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-668" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/PrivateRoute.tsx", "cwe": "CWE-602" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-deepseek-only": { "scanner": "kolega-claude-adaptation-deepseek-only", "tp": 22, "fp": 28, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.7857, "f1": 0.5641, "f2": 0.679, "f2_score": 67.9, "f3": 0.7285, "f3_score": 72.8, "tpr": 0.7857, "fpr": 0.875, "youden_j": -0.0893, "cvss_coverage": 1.0, "cvss_tp_weight": 132.9, "cvss_fp_weight": 203.5, "cvss_fn_weight": 31.1, "cvss_precision": 0.3951, "cvss_recall": 0.8104, "cvss_f3": 0.7333, "cvss_f3_score": 73.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.7059 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 11, "fp": 0, "fn": 3, "recall": 0.7857 }, "medium": { "tp": 9, "fp": 0, "fn": 3, "recall": 0.75 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-119", "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-552" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" } ] }, "kolega-claude-adaptation-v1": { "scanner": "kolega-claude-adaptation-v1", "tp": 1, "fp": 1, "fn": 27, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.0357, "f1": 0.0667, "f2": 0.0439, "f2_score": 4.4, "f3": 0.0394, "f3_score": 3.9, "tpr": 0.0357, "fpr": 0.2, "youden_j": -0.1643, "cvss_coverage": 1.0, "cvss_tp_weight": 7.4, "cvss_fp_weight": 9.5, "cvss_fn_weight": 156.6, "cvss_precision": 0.4379, "cvss_recall": 0.0451, "cvss_f3": 0.0496, "cvss_f3_score": 5.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.0588 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-core-v0.0.1": { "scanner": "kolega-devsec-core-v0.0.1", "tp": 27, "fp": 76, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2621, "recall": 0.9643, "f1": 0.4122, "f2": 0.6279, "f2_score": 62.8, "f3": 0.7606, "f3_score": 76.1, "tpr": 0.9643, "fpr": 0.95, "youden_j": 0.0143, "cvss_coverage": 1.0, "cvss_tp_weight": 157.5, "cvss_fp_weight": 502.5, "cvss_fn_weight": 6.5, "cvss_precision": 0.2386, "cvss_recall": 0.9604, "cvss_f3": 0.7374, "cvss_f3_score": 73.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-690" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-263" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-119", "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-659", "file": "backend/app/support_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/requirements.txt", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 22, "fp": 27, "fn": 6, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.449, "recall": 0.7857, "f1": 0.5714, "f2": 0.6832, "f2_score": 68.3, "f3": 0.7309, "f3_score": 73.1, "tpr": 0.7857, "fpr": 0.871, "youden_j": -0.0853, "cvss_coverage": 1.0, "cvss_tp_weight": 125.5, "cvss_fp_weight": 203.5, "cvss_fn_weight": 38.5, "cvss_precision": 0.3815, "cvss_recall": 0.7652, "cvss_f3": 0.6953, "cvss_f3_score": 69.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.7647 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 10, "fp": 0, "fn": 4, "recall": 0.7143 }, "medium": { "tp": 10, "fp": 0, "fn": 2, "recall": 0.8333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-659", "file": "backend/app/support_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/components/Layout.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "scanner": "kolega-original-claude-adaptation-deepseek-v4-pro", "tp": 18, "fp": 19, "fn": 10, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.4865, "recall": 0.6429, "f1": 0.5538, "f2": 0.604, "f2_score": 60.4, "f3": 0.6228, "f3_score": 62.3, "tpr": 0.6429, "fpr": 0.8261, "youden_j": -0.1832, "cvss_coverage": 1.0, "cvss_tp_weight": 111.6, "cvss_fp_weight": 106.5, "cvss_fn_weight": 52.4, "cvss_precision": 0.5117, "cvss_recall": 0.6805, "cvss_f3": 0.6588, "cvss_f3_score": 65.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5294 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 9, "fp": 0, "fn": 5, "recall": 0.6429 }, "medium": { "tp": 7, "fp": 0, "fn": 5, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "scripts/check_sla.py", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" } ] }, "kolega-v0.0.2-raw": { "scanner": "kolega-v0.0.2-raw", "tp": 27, "fp": 100, "fn": 1, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.2126, "recall": 0.9643, "f1": 0.3484, "f2": 0.5649, "f2_score": 56.5, "f3": 0.7124, "f3_score": 71.2, "tpr": 0.9643, "fpr": 0.9615, "youden_j": 0.0027, "cvss_coverage": 1.0, "cvss_tp_weight": 157.5, "cvss_fp_weight": 639.5, "cvss_fn_weight": 6.5, "cvss_precision": 0.1976, "cvss_recall": 0.9604, "cvss_f3": 0.6929, "cvss_f3_score": 69.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 13, "fp": 0, "fn": 1, "recall": 0.9286 }, "medium": { "tp": 12, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/database.py", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-690" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-263" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": "backend/app/main.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/models.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-119", "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-840" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-326" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-659", "file": "backend/app/support_operations.py", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-689", "file": "backend/app/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/requirements.txt", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/run.py", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/AdminSettings.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/Login.tsx", "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "minimax-m2.7-agentic-v1": { "scanner": "minimax-m2.7-agentic-v1", "tp": 7, "fp": 5, "fn": 21, "tn": 3, "ns": 0, "ns_gt": 0, "precision": 0.6014, "recall": 0.2619, "f1": 0.3644, "f2": 0.2951, "f2_score": 29.5, "f3": 0.2775, "f3_score": 27.7, "tpr": 0.2619, "fpr": 0.5852, "youden_j": -0.3233, "cvss_coverage": 1.0, "cvss_tp_weight": 46.6, "cvss_fp_weight": 23.7, "cvss_fn_weight": 117.4, "cvss_precision": 0.6704, "cvss_recall": 0.2839, "cvss_f3": 0.3012, "cvss_f3_score": 30.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 1, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.1765 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 3, "fp": 1, "fn": 11, "recall": 0.2143 }, "medium": { "tp": 3, "fp": 0, "fn": 9, "recall": 0.25 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "ornith-q3-agentic-v1": { "scanner": "ornith-q3-agentic-v1", "tp": 0, "fp": 11, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.7333, "youden_j": -0.7333, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 59.4, "cvss_fn_weight": 164.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "support_operations.py", "cwe": "CWE-933" }, { "classification": "FP", "ground_truth_id": null, "file": "database.py", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "qwen3.6-35b-agentic-v1": { "scanner": "qwen3.6-35b-agentic-v1", "tp": 14, "fp": 6, "fn": 14, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.7, "recall": 0.5, "f1": 0.5833, "f2": 0.5303, "f2_score": 53.0, "f3": 0.5147, "f3_score": 51.5, "tpr": 0.5, "fpr": 0.6, "youden_j": -0.1, "cvss_coverage": 1.0, "cvss_tp_weight": 85.7, "cvss_fp_weight": 22.6, "cvss_fn_weight": 78.3, "cvss_precision": 0.7913, "cvss_recall": 0.5226, "cvss_f3": 0.5409, "cvss_f3_score": 54.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4118 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 7, "fp": 0, "fn": 7, "recall": 0.5 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-726", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-230", "file": "backend/app/support_operations.py", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-669", "file": "backend/app/support_operations.py", "cwe": "CWE-693" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-120", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-1-118", "file": "backend/app/support_operations.py", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-206", "file": "backend/app/support_operations.py", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": "backend/app/auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": "backend/app/main.py", "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "rowan": { "scanner": "rowan", "tp": 8, "fp": 15, "fn": 20, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.3478, "recall": 0.2857, "f1": 0.3137, "f2": 0.2963, "f2_score": 29.6, "f3": 0.2909, "f3_score": 29.1, "tpr": 0.2857, "fpr": 0.7895, "youden_j": -0.5038, "cvss_coverage": 1.0, "cvss_tp_weight": 46.2, "cvss_fp_weight": 100.0, "cvss_fn_weight": 117.8, "cvss_precision": 0.316, "cvss_recall": 0.2817, "cvss_f3": 0.2848, "cvss_f3_score": 28.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2353 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 2, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 }, "medium": { "tp": 5, "fp": 0, "fn": 7, "recall": 0.4167 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-679", "file": "backend/app/support_operations.py", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-329", "file": "backend/app/support_operations.py", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-739", "file": "backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/auth.py", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-328" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "semgrep": { "scanner": "semgrep", "tp": 0, "fp": 5, "fn": 28, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.5556, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 22.1, "cvss_fn_weight": 164.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 17, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 2, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 14, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 12, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-support-desk-fastapi/backend/app/database.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-support-desk-fastapi/backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-939" }, { "classification": "FP", "ground_truth_id": null, "file": "repos/vc-kimi-code-seeded-v2-support-desk-fastapi/backend/app/support_operations.py", "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-165", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-286", "file": null, "cwe": "CWE-328" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-699", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-709", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-729", "file": null, "cwe": "CWE-16" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] }, "sonarqube": { "scanner": "sonarqube", "tp": 6, "fp": 54, "fn": 22, "tn": 4, "ns": 0, "ns_gt": 0, "precision": 0.1, "recall": 0.2143, "f1": 0.1364, "f2": 0.1744, "f2_score": 17.4, "f3": 0.1923, "f3_score": 19.2, "tpr": 0.2143, "fpr": 0.931, "youden_j": -0.7167, "cvss_coverage": 1.0, "cvss_tp_weight": 29.8, "cvss_fp_weight": 299.8, "cvss_fn_weight": 134.2, "cvss_precision": 0.0904, "cvss_recall": 0.1817, "cvss_f3": 0.165, "cvss_f3_score": 16.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 0, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.1176 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 1, "recall": 0.5 }, "high": { "tp": 1, "fp": 0, "fn": 13, "recall": 0.0714 }, "medium": { "tp": 4, "fp": 0, "fn": 8, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-002", "file": "backend/app/main.py", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/main.py", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/seed.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-165", "file": "backend/app/support_operations.py", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-2-286", "file": "backend/app/support_operations.py", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-699", "file": "backend/app/support_operations.py", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-606" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-709", "file": "backend/app/support_operations.py", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "seeded-v2-campaign-3-729", "file": "backend/app/support_operations.py", "cwe": "CWE-295" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/app/support_operations.py", "cwe": "CWE-297" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/tests/test_auth.py", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/services/api.ts", "cwe": "CWE-1104" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-118", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-119", "file": null, "cwe": "CWE-840" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-1-120", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-206", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-230", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-2-329", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-659", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-669", "file": null, "cwe": "CWE-1021" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-679", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-689", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-726", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "seeded-v2-campaign-3-739", "file": null, "cwe": "CWE-611" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-001", "file": null, "cwe": "CWE-862" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-002", "file": null, "cwe": "CWE-639" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-003", "file": null, "cwe": "CWE-798" }, { "classification": "TN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-fp-004", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-003", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-004", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-005", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-006", "file": null, "cwe": "CWE-552" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-008", "file": null, "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-009", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-010", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v2-support-desk-fastapi-enrich-011", "file": null, "cwe": "CWE-639" } ] } }, "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 19, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.4242, "recall": 0.35, "f1": 0.3836, "f2": 0.3627, "f2_score": 36.3, "f3": 0.3562, "f3_score": 35.6, "tpr": 0.35, "fpr": 1.0, "youden_j": -0.65, "cvss_coverage": 1.0, "cvss_tp_weight": 87.0, "cvss_fp_weight": 107.1, "cvss_fn_weight": 149.8, "cvss_precision": 0.4483, "cvss_recall": 0.3674, "cvss_f3": 0.3742, "cvss_f3_score": 37.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 26, "recall": 0.35 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 12, "fp": 26, "fn": 28, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.3158, "recall": 0.3, "f1": 0.3077, "f2": 0.303, "f2_score": 30.3, "f3": 0.3015, "f3_score": 30.2, "tpr": 0.3, "fpr": 1.0, "youden_j": -0.7, "cvss_coverage": 1.0, "cvss_tp_weight": 76.3, "cvss_fp_weight": 137.7, "cvss_fn_weight": 160.5, "cvss_precision": 0.3566, "cvss_recall": 0.3222, "cvss_f3": 0.3254, "cvss_f3_score": 32.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 28, "recall": 0.3 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-36" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-842" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-80" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 40, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 236.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 40, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 21, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.4324, "recall": 0.4, "f1": 0.4156, "f2": 0.4061, "f2_score": 40.6, "f3": 0.403, "f3_score": 40.3, "tpr": 0.4, "fpr": 1.0, "youden_j": -0.6, "cvss_coverage": 1.0, "cvss_tp_weight": 96.9, "cvss_fp_weight": 118.9, "cvss_fn_weight": 139.9, "cvss_precision": 0.449, "cvss_recall": 0.4092, "cvss_f3": 0.4129, "cvss_f3_score": 41.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 24, "recall": 0.4 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/audit-logs/audit-logs.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 45, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.2969, "recall": 0.475, "f1": 0.3654, "f2": 0.4241, "f2_score": 42.4, "f3": 0.4481, "f3_score": 44.8, "tpr": 0.475, "fpr": 1.0, "youden_j": -0.525, "cvss_coverage": 1.0, "cvss_tp_weight": 109.2, "cvss_fp_weight": 250.1, "cvss_fn_weight": 127.6, "cvss_precision": 0.3039, "cvss_recall": 0.4611, "cvss_f3": 0.4385, "cvss_f3_score": 43.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.3 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 21, "recall": 0.475 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/audit-logs/audit-logs.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-480" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 44, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.3016, "recall": 0.475, "f1": 0.3689, "f2": 0.426, "f2_score": 42.6, "f3": 0.4492, "f3_score": 44.9, "tpr": 0.475, "fpr": 1.0, "youden_j": -0.525, "cvss_coverage": 1.0, "cvss_tp_weight": 108.7, "cvss_fp_weight": 238.8, "cvss_fn_weight": 128.1, "cvss_precision": 0.3128, "cvss_recall": 0.459, "cvss_f3": 0.4385, "cvss_f3_score": 43.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.35 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 21, "recall": 0.475 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-704" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-91" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-565" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 50, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.3243, "recall": 0.6, "f1": 0.4211, "f2": 0.5128, "f2_score": 51.3, "f3": 0.553, "f3_score": 55.3, "tpr": 0.6, "fpr": 1.0, "youden_j": -0.4, "cvss_coverage": 1.0, "cvss_tp_weight": 144.8, "cvss_fp_weight": 290.6, "cvss_fn_weight": 92.0, "cvss_precision": 0.3326, "cvss_recall": 0.6115, "cvss_f3": 0.5642, "cvss_f3_score": 56.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.45 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 16, "recall": 0.6 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/config/database.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/utils/deep-assign.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/user.entity.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-91" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-674" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-324" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": null, "cwe": "CWE-639" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 40, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 236.8, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 20, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 40, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/utils/deep-assign.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": "backend/src/database/seed.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/modules/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 37, "fp": 53, "fn": 3, "tn": 0, "ns": 2, "ns_gt": 23, "precision": 0.4111, "recall": 0.925, "f1": 0.5692, "f2": 0.74, "f2_score": 74.0, "f3": 0.8222, "f3_score": 82.2, "tpr": 0.925, "fpr": 1.0, "youden_j": -0.075, "cvss_coverage": 1.0, "cvss_tp_weight": 217.9, "cvss_fp_weight": 413.0, "cvss_fn_weight": 18.9, "cvss_precision": 0.3454, "cvss_recall": 0.9202, "cvss_f3": 0.7889, "cvss_f3_score": 78.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 3, "recall": 0.925 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": "backend/src/common/utils/deep-assign.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.controller.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organizations.service.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": "backend/src/modules/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/users/users.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": "frontend/src/app/components/deals/deals-list.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/notifications/notifications.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": "backend/src/modules/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": "backend/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": "backend/src/database/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": "backend/src/modules/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": "backend/src/modules/auth/auth.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": "backend/src/modules/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/activity/activity.controller.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/organizations/organization-widgets.controller.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": "backend/src/modules/webhooks/webhooks.controller.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-915" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 30, "fn": 35, "tn": 0, "ns": 0, "ns_gt": 23, "precision": 0.1429, "recall": 0.125, "f1": 0.1333, "f2": 0.1282, "f2_score": 12.8, "f3": 0.1266, "f3_score": 12.7, "tpr": 0.125, "fpr": 1.0, "youden_j": -0.875, "cvss_coverage": 1.0, "cvss_tp_weight": 31.8, "cvss_fp_weight": 177.6, "cvss_fn_weight": 205.0, "cvss_precision": 0.1519, "cvss_recall": 0.1343, "cvss_f3": 0.1359, "cvss_f3_score": 13.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 35, "recall": 0.125 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-027", "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/api-keys/api-keys.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/deals/deals.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/documents/documents.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-045", "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/escalations/escalations.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-046", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-047", "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/modules/imports/imports.service.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-063", "file": "frontend/src/app/components/escalations/escalation-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-001", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-002", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-028", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-030", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-031", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-032", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-034", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-035", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-036", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-037", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-038", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-039", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-041", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-042", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-043", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-044", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-048", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-049", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-050", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-051", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-052", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-053", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-054", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-055", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-056", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-057", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-058", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-059", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-060", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-061", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-062", "file": null, "cwe": "CWE-79" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-010", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-011", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-012", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-013", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-014", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-015", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-016", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-017", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-018", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-019", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-020", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-021", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-022", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-023", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-024", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-025", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular-026", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-education-lms-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 20, "fp": 43, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3175, "recall": 0.4348, "f1": 0.367, "f2": 0.4049, "f2_score": 40.5, "f3": 0.4193, "f3_score": 41.9, "tpr": 0.4348, "fpr": 1.0, "youden_j": -0.5652, "cvss_coverage": 1.0, "cvss_tp_weight": 138.2, "cvss_fp_weight": 226.5, "cvss_fn_weight": 146.7, "cvss_precision": 0.379, "cvss_recall": 0.4851, "cvss_f3": 0.4719, "cvss_f3_score": 47.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.381 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 19, "fp": 0, "fn": 26, "recall": 0.4222 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileReview.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-208" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-696" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": "generated-education-lms-nextjs/src/app/api/enrollment/status/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/requestIntegrity.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/gradesync/route.ts", "cwe": "CWE-942" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 24, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4146, "recall": 0.3696, "f1": 0.3908, "f2": 0.3778, "f2_score": 37.8, "f3": 0.3736, "f3_score": 37.4, "tpr": 0.3696, "fpr": 1.0, "youden_j": -0.6304, "cvss_coverage": 1.0, "cvss_tp_weight": 113.6, "cvss_fp_weight": 137.3, "cvss_fn_weight": 171.3, "cvss_precision": 0.4528, "cvss_recall": 0.3987, "cvss_f3": 0.4036, "cvss_f3_score": 40.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.1905 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 17, "fp": 0, "fn": 28, "recall": 0.3778 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendor-profile-sync/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendor-profile-sync/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/widget/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/export/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 46, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 284.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 45, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-347" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 0, "fp": 36, "fn": 46, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 211.6, "cvss_fn_weight": 284.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 21, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 0, "fp": 0, "fn": 45, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/staffDirectory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/vendorProfileSync.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/integrations/gradesync/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/grades/recalc-diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/resource/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/cohorts/team/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/companion/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/security/draftCipher.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/db/index.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-347" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": null, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 46, "fp": 33, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5823, "recall": 1.0, "f1": 0.736, "f2": 0.8745, "f2_score": 87.5, "f3": 0.9331, "f3_score": 93.3, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 284.9, "cvss_fp_weight": 198.7, "cvss_fn_weight": 0.0, "cvss_precision": 0.5891, "cvss_recall": 1.0, "cvss_f3": 0.9348, "cvss_f3_score": 93.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 45, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": "generated-education-lms-nextjs/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": "generated-education-lms-nextjs/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": "generated-education-lms-nextjs/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": "generated-education-lms-nextjs/src/app/api/account/credentials/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": "generated-education-lms-nextjs/src/app/api/cohorts/redeem/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": "generated-education-lms-nextjs/src/app/api/companion/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": "generated-education-lms-nextjs/src/app/api/enrollment/status/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": "generated-education-lms-nextjs/src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": "generated-education-lms-nextjs/src/lib/activityLogger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": "generated-education-lms-nextjs/src/lib/auth/session.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": "generated-education-lms-nextjs/src/lib/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": "generated-education-lms-nextjs/src/lib/security/requestIntegrity.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileReview.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendor-profile-sync/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource-bundle/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/widget/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/notes-search/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/auth/apiKey.ts", "cwe": "CWE-613" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 29, "fp": 59, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3295, "recall": 0.6304, "f1": 0.4328, "f2": 0.5331, "f2_score": 53.3, "f3": 0.5777, "f3_score": 57.8, "tpr": 0.6304, "fpr": 1.0, "youden_j": -0.3696, "cvss_coverage": 1.0, "cvss_tp_weight": 187.7, "cvss_fp_weight": 365.4, "cvss_fn_weight": 97.2, "cvss_precision": 0.3394, "cvss_recall": 0.6588, "cvss_f3": 0.6021, "cvss_f3_score": 60.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.619 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 28, "fp": 0, "fn": 17, "recall": 0.6222 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileReview.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": "generated-education-lms-nextjs/src/lib/auth/session.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/auth/apiKey.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/auth/apiKey.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/resubmit/route.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": "generated-education-lms-nextjs/src/app/api/enrollment/status/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/export/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/widget/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource-bundle/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/materials/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/notes-search/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/recalc-diagnostics/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/history/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/state-backup/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": "generated-education-lms-nextjs/src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": "generated-education-lms-nextjs/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": "generated-education-lms-nextjs/src/lib/db/index.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 24, "fp": 48, "fn": 22, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3333, "recall": 0.5217, "f1": 0.4068, "f2": 0.4688, "f2_score": 46.9, "f3": 0.4938, "f3_score": 49.4, "tpr": 0.5217, "fpr": 1.0, "youden_j": -0.4783, "cvss_coverage": 1.0, "cvss_tp_weight": 157.7, "cvss_fp_weight": 280.2, "cvss_fn_weight": 127.2, "cvss_precision": 0.3601, "cvss_recall": 0.5535, "cvss_f3": 0.5253, "cvss_f3_score": 52.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4762 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 24, "fp": 0, "fn": 21, "recall": 0.5333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/keys/generate/route.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": "generated-education-lms-nextjs/src/lib/auth/session.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileReview.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/history/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource-bundle/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/materials/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/export/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/widget/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/notes-search/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": "generated-education-lms-nextjs/src/app/api/enrollment/status/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/submissions/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/users/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/grades/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/auth/apiKey.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": "generated-education-lms-nextjs/src/app/api/cohorts/redeem/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/pairing/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/calendar-sync/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 45, "fp": 62, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4206, "recall": 0.9783, "f1": 0.5882, "f2": 0.7732, "f2_score": 77.3, "f3": 0.8637, "f3_score": 86.4, "tpr": 0.9783, "fpr": 1.0, "youden_j": -0.0217, "cvss_coverage": 1.0, "cvss_tp_weight": 280.1, "cvss_fp_weight": 487.5, "cvss_fn_weight": 4.8, "cvss_precision": 0.3649, "cvss_recall": 0.9832, "cvss_f3": 0.8407, "cvss_f3_score": 84.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.75 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 21, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 }, "high": { "tp": 44, "fp": 0, "fn": 1, "recall": 0.9778 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/courses.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/gradeAnalytics.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": "generated-education-lms-nextjs/src/actions/handoutCatalog.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileReview.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/archive/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": "generated-education-lms-nextjs/src/app/api/cohorts/redeem/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/team/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/calendar-sync/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/pairing/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": "generated-education-lms-nextjs/src/app/api/courses/syllabus-preview/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/export/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/pin/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/thread-search/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/discussions/widget/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": "generated-education-lms-nextjs/src/app/api/enrollment/continue/route.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/enrollment/eligibility/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": "generated-education-lms-nextjs/src/app/api/enrollment/status/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource-bundle/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/recalc-diagnostics/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/recalc-diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": "generated-education-lms-nextjs/src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/import/enrollments/diagnostics/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": "generated-education-lms-nextjs/src/app/api/integrations/vendorpush/route.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": "generated-education-lms-nextjs/src/app/api/submissions/detail/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": "generated-education-lms-nextjs/src/app/api/submissions/draft-resume/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/notes-search/route.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/submissions/notes-search/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/components/announcements/announcement-preview.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": "generated-education-lms-nextjs/src/lib/activityLogger.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/activityLogger.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/auth/session.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": "generated-education-lms-nextjs/src/lib/security/resourceGrant.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": "generated-education-lms-nextjs/src/actions/assignments.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": "generated-education-lms-nextjs/src/actions/settings.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": "generated-education-lms-nextjs/src/actions/vendorProfileSync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": "generated-education-lms-nextjs/src/app/api/companion/pairing/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": "generated-education-lms-nextjs/src/app/api/account/credentials/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/notifications/widget-state-v2/route.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/notifications/widget-state/route.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": "generated-education-lms-nextjs/src/lib/auth/session.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/announcements.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": "generated-education-lms-nextjs/src/actions/discussions.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": "generated-education-lms-nextjs/src/app/api/grades/release/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": "generated-education-lms-nextjs/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": "generated-education-lms-nextjs/scripts/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": "generated-education-lms-nextjs/src/lib/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": "generated-education-lms-nextjs/src/lib/security/requestIntegrity.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-redeem/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/invite-verify/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/cohorts/roster-grant/[token]/route.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": "generated-education-lms-nextjs/src/app/api/grades/dispute/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendor-profile-review/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/integrations/vendor-profile-sync/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 6, "fp": 22, "fn": 40, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2143, "recall": 0.1304, "f1": 0.1622, "f2": 0.1415, "f2_score": 14.2, "f3": 0.1357, "f3_score": 13.6, "tpr": 0.1304, "fpr": 1.0, "youden_j": -0.8696, "cvss_coverage": 1.0, "cvss_tp_weight": 44.1, "cvss_fp_weight": 136.3, "cvss_fn_weight": 240.8, "cvss_precision": 0.2445, "cvss_recall": 0.1548, "cvss_f3": 0.1607, "cvss_f3_score": 16.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 20, "precision": 1.0, "recall": 0.0476 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 }, "high": { "tp": 6, "fp": 0, "fn": 39, "recall": 0.1333 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/actions/users.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/companion/state-backup/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-021", "file": "generated-education-lms-nextjs/src/app/api/companion/state-sync/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/emblem-upload/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/courses/materials/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-028", "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout-preview/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/handout/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/resource-bundle/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/syllabus-preview-render/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/syllabus-preview-render/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-029", "file": "generated-education-lms-nextjs/src/app/api/export/transcript/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-030", "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/files/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-036", "file": "generated-education-lms-nextjs/src/app/api/submissions/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/app/api/users/avatar-upload/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-039", "file": "generated-education-lms-nextjs/src/components/notifications/notification-item.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/notifications/widgetStateCodec.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-education-lms-nextjs/src/lib/security/draftCipher.ts", "cwe": "CWE-310" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-004", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-005", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-007", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-008", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-009", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-010", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-011", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-013", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-014", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-015", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-016", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-017", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-018", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-019", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-020", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-022", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-023", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-024", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-031", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-033", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-034", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-035", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-038", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-040", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-041", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-043", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-044", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-045", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-education-lms-nextjs-046", "file": null, "cwe": "CWE-347" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-fintech-lending-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 17, "fp": 11, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6071, "recall": 0.4048, "f1": 0.4857, "f2": 0.4337, "f2_score": 43.4, "f3": 0.4187, "f3_score": 41.9, "tpr": 0.4048, "fpr": 1.0, "youden_j": -0.5952, "cvss_coverage": 1.0, "cvss_tp_weight": 93.0, "cvss_fp_weight": 50.8, "cvss_fn_weight": 139.5, "cvss_precision": 0.6466, "cvss_recall": 0.4, "cvss_f3": 0.4159, "cvss_f3_score": 41.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2105 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 25, "recall": 0.4048 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-16" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 14, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5484, "recall": 0.4048, "f1": 0.4658, "f2": 0.4271, "f2_score": 42.7, "f3": 0.4156, "f3_score": 41.6, "tpr": 0.4048, "fpr": 1.0, "youden_j": -0.5952, "cvss_coverage": 1.0, "cvss_tp_weight": 92.4, "cvss_fp_weight": 52.3, "cvss_fn_weight": 140.1, "cvss_precision": 0.6385, "cvss_recall": 0.3974, "cvss_f3": 0.413, "cvss_f3_score": 41.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.2105 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 25, "recall": 0.4048 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 42, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 232.5, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 19, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 42, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 23, "fp": 27, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.46, "recall": 0.5476, "f1": 0.5, "f2": 0.5275, "f2_score": 52.8, "f3": 0.5374, "f3_score": 53.7, "tpr": 0.5476, "fpr": 1.0, "youden_j": -0.4524, "cvss_coverage": 1.0, "cvss_tp_weight": 118.8, "cvss_fp_weight": 144.4, "cvss_fn_weight": 113.7, "cvss_precision": 0.4513, "cvss_recall": 0.511, "cvss_f3": 0.5043, "cvss_f3_score": 50.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.3158 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 19, "recall": 0.5476 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/config/database.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 27, "fp": 33, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.45, "recall": 0.6429, "f1": 0.5294, "f2": 0.5921, "f2_score": 59.2, "f3": 0.6164, "f3_score": 61.6, "tpr": 0.6429, "fpr": 1.0, "youden_j": -0.3571, "cvss_coverage": 1.0, "cvss_tp_weight": 141.3, "cvss_fp_weight": 172.6, "cvss_fn_weight": 91.2, "cvss_precision": 0.4501, "cvss_recall": 0.6077, "cvss_f3": 0.5872, "cvss_f3_score": 58.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.4211 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 15, "recall": 0.6429 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-693" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": "server/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 26, "fp": 28, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4815, "recall": 0.619, "f1": 0.5417, "f2": 0.5856, "f2_score": 58.6, "f3": 0.6019, "f3_score": 60.2, "tpr": 0.619, "fpr": 1.0, "youden_j": -0.381, "cvss_coverage": 1.0, "cvss_tp_weight": 143.6, "cvss_fp_weight": 134.9, "cvss_fn_weight": 88.9, "cvss_precision": 0.5157, "cvss_recall": 0.6176, "cvss_f3": 0.6057, "cvss_f3_score": 60.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4737 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 16, "recall": 0.619 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/config/database.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-16" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/applications.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/portfolioMaintenanceController.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": "server/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 24, "fp": 27, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 0.5714, "f1": 0.5161, "f2": 0.5479, "f2_score": 54.8, "f3": 0.5594, "f3_score": 55.9, "tpr": 0.5714, "fpr": 1.0, "youden_j": -0.4286, "cvss_coverage": 1.0, "cvss_tp_weight": 132.3, "cvss_fp_weight": 149.5, "cvss_fn_weight": 100.2, "cvss_precision": 0.4695, "cvss_recall": 0.569, "cvss_f3": 0.5572, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5263 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 18, "recall": 0.5714 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-834" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/portfolioMaintenanceController.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-248" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 39, "fp": 18, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6842, "recall": 0.9286, "f1": 0.7879, "f2": 0.8667, "f2_score": 86.7, "f3": 0.8966, "f3_score": 89.7, "tpr": 0.9286, "fpr": 1.0, "youden_j": -0.0714, "cvss_coverage": 1.0, "cvss_tp_weight": 210.9, "cvss_fp_weight": 94.6, "cvss_fn_weight": 21.6, "cvss_precision": 0.6903, "cvss_recall": 0.9071, "cvss_f3": 0.8795, "cvss_f3_score": 87.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9474 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 3, "recall": 0.9286 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": "server/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/noteController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/middleware/upload.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/services/secretsManagerClient.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 38, "fp": 33, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5352, "recall": 0.9048, "f1": 0.6726, "f2": 0.795, "f2_score": 79.5, "f3": 0.8463, "f3_score": 84.6, "tpr": 0.9048, "fpr": 1.0, "youden_j": -0.0952, "cvss_coverage": 1.0, "cvss_tp_weight": 203.8, "cvss_fp_weight": 249.0, "cvss_fn_weight": 28.7, "cvss_precision": 0.4501, "cvss_recall": 0.8766, "cvss_f3": 0.8007, "cvss_f3_score": 80.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9474 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 38, "fp": 0, "fn": 4, "recall": 0.9048 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/auditLogController.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": "server/src/controllers/authController.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": "server/src/controllers/authController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": "server/src/controllers/messageController.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": "server/src/services/staffDirectoryService.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": "server/src/utils/logger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/apiKeyController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": "server/src/controllers/authController.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": "server/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/authController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/index.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": "server/src/routes/applications.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/routes/auth.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 13, "fp": 80, "fn": 29, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1398, "recall": 0.3095, "f1": 0.1926, "f2": 0.249, "f2_score": 24.9, "f3": 0.276, "f3_score": 27.6, "tpr": 0.3095, "fpr": 1.0, "youden_j": -0.6905, "cvss_coverage": 1.0, "cvss_tp_weight": 65.8, "cvss_fp_weight": 427.7, "cvss_fn_weight": 166.7, "cvss_precision": 0.1333, "cvss_recall": 0.283, "cvss_f3": 0.2544, "cvss_f3_score": 25.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1579 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 29, "recall": 0.3095 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/borrowerProfileController.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-011", "file": "server/src/controllers/decisionController.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-012", "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/documentController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-016", "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/importExportController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-017", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-018", "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/lendingProductController.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/loanApplicationController.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-024", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-025", "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/marketplaceLinkController.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/messageController.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-028", "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/notificationController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-031", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-74" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-032", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-033", "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/payoutController.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/reviewContinuityController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-035", "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/userController.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-036", "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "server/src/controllers/webhookController.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-001", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-003", "file": null, "cwe": "CWE-384" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-005", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-006", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-007", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-008", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-009", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-010", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-013", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-014", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-015", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-019", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-020", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-021", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-022", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-023", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-026", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-029", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-030", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-034", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-037", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-038", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-040", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-fintech-lending-express-042", "file": null, "cwe": "CWE-117" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 16, "fp": 39, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.2909, "recall": 0.4444, "f1": 0.3516, "f2": 0.402, "f2_score": 40.2, "f3": 0.4222, "f3_score": 42.2, "tpr": 0.4444, "fpr": 1.0, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 106.7, "cvss_fp_weight": 200.1, "cvss_fn_weight": 114.5, "cvss_precision": 0.3478, "cvss_recall": 0.4824, "cvss_f3": 0.4644, "cvss_f3_score": 46.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 19, "recall": 0.4571 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/lab-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/lab-summary/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/login/LoginForm.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/app/api/integrations/provider-sync/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/tier-lookup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/tier-lookup/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/members/route.ts", "cwe": "CWE-522" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/badge-lookup/route.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/refill-handoff/route.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/availability/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/board-tuning/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/embed/satisfaction-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk-badge/route.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/auth/mobile-session/route.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk-badge/route.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk-badge/route.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/login/LoginForm.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(auth)/login/LoginForm.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk/route.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 10, "fp": 17, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3704, "recall": 0.2778, "f1": 0.3175, "f2": 0.2924, "f2_score": 29.2, "f3": 0.2849, "f3_score": 28.5, "tpr": 0.2778, "fpr": 1.0, "youden_j": -0.7222, "cvss_coverage": 1.0, "cvss_tp_weight": 72.1, "cvss_fp_weight": 98.8, "cvss_fn_weight": 149.1, "cvss_precision": 0.4219, "cvss_recall": 0.3259, "cvss_f3": 0.3335, "cvss_f3_score": 33.4, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1111 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 10, "fp": 0, "fn": 25, "recall": 0.2857 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-23" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/badge-lookup/route.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-sheets.ts", "cwe": "CWE-80" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-78" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 221.2, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 35, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": null, "cwe": "CWE-78" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 16, "fp": 20, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.4444, "recall": 0.4444, "f1": 0.4444, "f2": 0.4444, "f2_score": 44.4, "f3": 0.4444, "f3_score": 44.4, "tpr": 0.4444, "fpr": 1.0, "youden_j": -0.5556, "cvss_coverage": 1.0, "cvss_tp_weight": 111.2, "cvss_fp_weight": 117.2, "cvss_fn_weight": 110.0, "cvss_precision": 0.4868, "cvss_recall": 0.5027, "cvss_f3": 0.5011, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 15, "fp": 0, "fn": 20, "recall": 0.4286 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/ccd-section-index.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/app/api/integrations/provider-sync/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/badge-lookup/route.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-sheets.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/care-plan-notes.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth-destinations.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-649" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/embed/satisfaction-widget/route.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/tier-lookup/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/board-tuning/route.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 38, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3333, "recall": 0.5278, "f1": 0.4086, "f2": 0.4726, "f2_score": 47.3, "f3": 0.4987, "f3_score": 49.9, "tpr": 0.5278, "fpr": 1.0, "youden_j": -0.4722, "cvss_coverage": 1.0, "cvss_tp_weight": 128.1, "cvss_fp_weight": 216.6, "cvss_fn_weight": 93.1, "cvss_precision": 0.3717, "cvss_recall": 0.5791, "cvss_f3": 0.5485, "cvss_f3_score": 54.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 16, "recall": 0.5429 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/ccd-section-index.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/embed/checkin-sync/route.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/print-queue/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/tier-lookup/route.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/tier-lookup/route.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth-destinations.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-sheets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/consult-letter/route.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/consult-letter/route.ts", "cwe": "CWE-644" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/badge-lookup/route.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/app/api/integrations/provider-sync/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/refill-handoff/route.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/prescriptions/refill-handoff/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/embed/satisfaction-widget/route.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/care-plan-notes.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/care-plan-notes.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-328" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 34, "fp": 2, "fn": 2, "tn": 0, "ns": 3, "ns_gt": 4, "precision": 0.9444, "recall": 0.9444, "f1": 0.9444, "f2": 0.9444, "f2_score": 94.4, "f3": 0.9444, "f3_score": 94.4, "tpr": 0.9444, "fpr": 1.0, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 209.4, "cvss_fp_weight": 12.3, "cvss_fn_weight": 11.8, "cvss_precision": 0.9446, "cvss_recall": 0.9467, "cvss_f3": 0.9464, "cvss_f3_score": 94.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 2, "recall": 0.9429 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/actions/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/actions/schedules.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/app/api/export/visit-summaries/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/app/api/integrations/provider-sync/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/ccd-section-index.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": "src/lib/kiosk-widget-sessions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/print-cache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 18, "fp": 28, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3913, "recall": 0.5, "f1": 0.439, "f2": 0.4737, "f2_score": 47.4, "f3": 0.4865, "f3_score": 48.6, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 119.1, "cvss_fp_weight": 172.0, "cvss_fn_weight": 102.1, "cvss_precision": 0.4091, "cvss_recall": 0.5384, "cvss_f3": 0.5219, "cvss_f3_score": 52.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 18, "recall": 0.4857 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/permissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(clinician)/clinician/visit-summaries/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/lab-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/patients.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(patient)/patient/appointments/book/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/summary/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/ccd-section-index.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-sheets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-362" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 18, "fp": 35, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.3396, "recall": 0.5, "f1": 0.4045, "f2": 0.4569, "f2_score": 45.7, "f3": 0.4775, "f3_score": 47.7, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 126.9, "cvss_fp_weight": 203.8, "cvss_fn_weight": 94.3, "cvss_precision": 0.3838, "cvss_recall": 0.5737, "cvss_f3": 0.5466, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.2222 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 17, "recall": 0.5143 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/permissions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/documents.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-sheets.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/lab-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/consult-letter/route.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/badge-lookup/route.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk-badge/route.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(clinician)/clinician/patients/page.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/(patient)/patient/appointments/book/page.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/summary/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/directory-search/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/visit-summaries/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/visit-summaries/route.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 34, "fp": 34, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.5, "recall": 0.9444, "f1": 0.6538, "f2": 0.8019, "f2_score": 80.2, "f3": 0.8673, "f3_score": 86.7, "tpr": 0.9444, "fpr": 1.0, "youden_j": -0.0556, "cvss_coverage": 1.0, "cvss_tp_weight": 206.1, "cvss_fp_weight": 254.0, "cvss_fn_weight": 15.1, "cvss_precision": 0.4479, "cvss_recall": 0.9317, "cvss_f3": 0.8409, "cvss_f3_score": 84.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 2, "recall": 0.9429 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": "src/actions/auth.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": "src/actions/billing.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/care-plan-notes.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/patients.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": "src/actions/schedules.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": "src/actions/timezone-reports.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/[id]/download/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/ccd-section/route.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/lab-summary/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/partner-referral/route.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/export/appointments/route.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": "src/app/api/export/visit-summaries/route.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": "src/app/api/insurance/live-eligibility-check/route.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": "src/app/api/network/resource-check/route.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/[id]/summary/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/directory-search/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/roster-search/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/patients/visit-recap/route.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/utilization/route.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": "src/app/api/team/members/route.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": "src/app/api/team/onboard-staff/route.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/activity-logger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": "src/lib/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": "src/lib/ccd-section-index.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": "src/lib/companion-widget-sync.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": "src/lib/kiosk-widget-sessions.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": "src/lib/print-cache.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": "src/actions/patients.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": "src/app/api/integrations/provider-sync/route.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": "src/actions/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": "src/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/kiosk-widget-sessions.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/auth.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": "src/actions/auth.ts", "cwe": "CWE-304" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/appointments/care-plan-series/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": "src/app/api/appointments/recurring-series/route.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": "src/app/api/patients/[id]/care-summary/route.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "src/actions/prescriptions.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": "src/lib/lab-results-gateway.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/checkin/kiosk-widget-logout/route.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/reports/referral-volume/route.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 15, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 4, "precision": 0.2105, "recall": 0.1111, "f1": 0.1455, "f2": 0.1227, "f2_score": 12.3, "f3": 0.1166, "f3_score": 11.7, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 31.6, "cvss_fp_weight": 86.5, "cvss_fn_weight": 189.6, "cvss_precision": 0.2675, "cvss_recall": 0.1429, "cvss_f3": 0.1498, "cvss_f3_score": 15.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 31, "recall": 0.1143 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/appointment-packet/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/appointment-packet/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-015", "file": "src/app/api/documents/fax-intake/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-016", "file": "src/app/api/documents/handout-template/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/letterhead-asset/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/scanned-intake/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-019", "file": "src/app/api/documents/visit-letter/route.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-import/route.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/insurance/eligibility-status/route.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "src/app/api/messages/attachment/route.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-cache.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-040", "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/print-render.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "src/lib/staff-directory-fixture.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "src/middleware.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-006", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-007", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-008", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-009", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-010", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-011", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-012", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-013", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-014", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-017", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-018", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-020", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-021", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-023", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-025", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-026", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-029", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-030", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-031", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-032", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-033", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-034", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-036", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-037", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-038", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-039", "file": null, "cwe": "CWE-73" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-002", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-003", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs-005", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-hr-payroll-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 12, "fp": 18, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4, "recall": 0.3333, "f1": 0.3636, "f2": 0.3448, "f2_score": 34.5, "f3": 0.339, "f3_score": 33.9, "tpr": 0.3333, "fpr": 1.0, "youden_j": -0.6667, "cvss_coverage": 1.0, "cvss_tp_weight": 83.0, "cvss_fp_weight": 110.8, "cvss_fn_weight": 138.7, "cvss_precision": 0.4282, "cvss_recall": 0.3744, "cvss_f3": 0.3791, "cvss_f3_score": 37.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.2 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 12, "fp": 0, "fn": 24, "recall": 0.3333 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.departments.tsx", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.departments.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/notifications.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/notifications.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/reportIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/reportIndex.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 0, "fp": 0, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 221.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 36, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 221.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 36, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 0, "fp": 34, "fn": 36, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 1.0, "youden_j": -1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 192.4, "cvss_fn_weight": 221.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 36, "recall": 0.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/payroll.callback.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.$id.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/departmentChart.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/notifications.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/auth.reset-password.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/documents.$id.tsx", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.new.tsx", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/employees.$id.edit.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/routes/compensation.summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/reportIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/draftCipher.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "app/utils/payrollSync.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 20, "fp": 25, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4444, "recall": 0.5556, "f1": 0.4938, "f2": 0.5291, "f2_score": 52.9, "f3": 0.542, "f3_score": 54.2, "tpr": 0.5556, "fpr": 1.0, "youden_j": -0.4444, "cvss_coverage": 1.0, "cvss_tp_weight": 120.6, "cvss_fp_weight": 137.0, "cvss_fn_weight": 101.1, "cvss_precision": 0.4682, "cvss_recall": 0.544, "cvss_f3": 0.5353, "cvss_f3_score": 53.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.4667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 16, "recall": 0.5556 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.departments.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.tsx", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/reportIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/notifications.tsx", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.import.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.tsx", "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 19, "fp": 35, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3519, "recall": 0.5278, "f1": 0.4222, "f2": 0.4798, "f2_score": 48.0, "f3": 0.5026, "f3_score": 50.3, "tpr": 0.5278, "fpr": 1.0, "youden_j": -0.4722, "cvss_coverage": 1.0, "cvss_tp_weight": 118.4, "cvss_fp_weight": 215.5, "cvss_fn_weight": 103.3, "cvss_precision": 0.3546, "cvss_recall": 0.5341, "cvss_f3": 0.5083, "cvss_f3_score": 50.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 17, "recall": 0.5278 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/notifications.tsx", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/reportIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.import.tsx", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/_layout.tsx", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/notifications.ts", "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 21, "fp": 43, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3281, "recall": 0.5833, "f1": 0.42, "f2": 0.5048, "f2_score": 50.5, "f3": 0.5412, "f3_score": 54.1, "tpr": 0.5833, "fpr": 1.0, "youden_j": -0.4167, "cvss_coverage": 1.0, "cvss_tp_weight": 135.4, "cvss_fp_weight": 264.8, "cvss_fn_weight": 86.3, "cvss_precision": 0.3383, "cvss_recall": 0.6107, "cvss_f3": 0.5652, "cvss_f3_score": 56.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 15, "recall": 0.5833 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-776" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/auth.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.import.tsx", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": "generated-hr-payroll-remix/app/db/seed.ts", "cwe": "CWE-259" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/reportIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-674" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.new.tsx", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 36, "fp": 0, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 1.0, "recall": 1.0, "f1": 1.0, "f2": 1.0, "f2_score": 100.0, "f3": 1.0, "f3_score": 100.0, "tpr": 1.0, "fpr": 0.0, "youden_j": 1.0, "cvss_coverage": 1.0, "cvss_tp_weight": 221.7, "cvss_fp_weight": 0.0, "cvss_fn_weight": 0.0, "cvss_precision": 1.0, "cvss_recall": 1.0, "cvss_f3": 1.0, "cvss_f3_score": 100.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 36, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": "generated-hr-payroll-remix/app/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": "generated-hr-payroll-remix/app/routes/admin.users.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": "generated-hr-payroll-remix/app/utils/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": "generated-hr-payroll-remix/app/utils/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": "generated-hr-payroll-remix/app/utils/serviceToken.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-321" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 33, "fp": 42, "fn": 3, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.44, "recall": 0.9167, "f1": 0.5946, "f2": 0.7534, "f2_score": 75.3, "f3": 0.8271, "f3_score": 82.7, "tpr": 0.9167, "fpr": 1.0, "youden_j": -0.0833, "cvss_coverage": 1.0, "cvss_tp_weight": 199.6, "cvss_fp_weight": 325.0, "cvss_fn_weight": 22.1, "cvss_precision": 0.3805, "cvss_recall": 0.9003, "cvss_f3": 0.7921, "cvss_f3_score": 79.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 33, "fp": 0, "fn": 3, "recall": 0.9167 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/_layout.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": "generated-hr-payroll-remix/app/routes/admin.audit-log.tsx", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.departments.tsx", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.departments.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": "generated-hr-payroll-remix/app/routes/admin.users.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/auth.verify-email.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/dashboard.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/profile.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/profile.tsx", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.new.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": "generated-hr-payroll-remix/app/routes/requests.summary.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": "generated-hr-payroll-remix/app/utils/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": "generated-hr-payroll-remix/app/utils/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": "generated-hr-payroll-remix/app/utils/payrollSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": "generated-hr-payroll-remix/app/utils/serviceToken.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/profile.tsx", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/api-keys.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": "generated-hr-payroll-remix/app/routes/auth.reset-password.ts", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.$id.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": "generated-hr-payroll-remix/app/routes/employees.$id.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": "generated-hr-payroll-remix/app/utils/benefitsCarrier.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": "generated-hr-payroll-remix/app/utils/session.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/compensation.summary.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/payroll.callback.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/requests.$id.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.tsx", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 4, "fp": 29, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1212, "recall": 0.1111, "f1": 0.1159, "f2": 0.113, "f2_score": 11.3, "f3": 0.112, "f3_score": 11.2, "tpr": 0.1111, "fpr": 1.0, "youden_j": -0.8889, "cvss_coverage": 1.0, "cvss_tp_weight": 32.9, "cvss_fp_weight": 172.9, "cvss_fn_weight": 188.8, "cvss_precision": 0.1598, "cvss_recall": 0.1484, "cvss_f3": 0.1495, "cvss_f3_score": 14.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 4, "fp": 0, "fn": 32, "recall": 0.1111 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/lib/legacyArchiveIndex.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-004", "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/admin.export.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-010", "file": "generated-hr-payroll-remix/app/routes/compensation.new.tsx", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/documents.upload.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/employees.$id.edit.tsx", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/notifications.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-021", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-022", "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/policies.tsx", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/routes/tasks.$id.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/corporateDirectory.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/departmentChart.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/draftCipher.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/notifications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-hr-payroll-remix/app/utils/profilePhoto.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-002", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-003", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-005", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-006", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-007", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-008", "file": null, "cwe": "CWE-640" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-009", "file": null, "cwe": "CWE-863" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-011", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-012", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-013", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-014", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-015", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-016", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-017", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-019", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-020", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-023", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-024", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-027", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-028", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-029", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-030", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-031", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-032", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-033", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-034", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-035", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-hr-payroll-remix-036", "file": null, "cwe": "CWE-321" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-legal-case-remix": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 24, "fp": 27, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4706, "recall": 0.5854, "f1": 0.5217, "f2": 0.5581, "f2_score": 55.8, "f3": 0.5714, "f3_score": 57.1, "tpr": 0.5854, "fpr": 1.0, "youden_j": -0.4146, "cvss_coverage": 1.0, "cvss_tp_weight": 161.5, "cvss_fp_weight": 169.6, "cvss_fn_weight": 105.2, "cvss_precision": 0.4877, "cvss_recall": 0.6055, "cvss_f3": 0.5913, "cvss_f3_score": 59.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 24, "fp": 0, "fn": 17, "recall": 0.5854 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/continuation.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/message-macros.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/message-macros.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-522" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": "generated-legal-case-remix/app/lib/citation-preview.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-embed.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-93" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 16, "fp": 13, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5517, "recall": 0.3902, "f1": 0.4571, "f2": 0.4145, "f2_score": 41.5, "f3": 0.402, "f3_score": 40.2, "tpr": 0.3902, "fpr": 1.0, "youden_j": -0.6098, "cvss_coverage": 1.0, "cvss_tp_weight": 109.3, "cvss_fp_weight": 78.6, "cvss_fn_weight": 157.4, "cvss_precision": 0.5818, "cvss_recall": 0.4098, "cvss_f3": 0.4223, "cvss_f3_score": 42.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.2778 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 25, "recall": 0.3902 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-formatting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.timeline-export.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.intake-sync.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.citation-preview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.clients.$clientId.edit.tsx", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 41, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 266.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 41, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 23, "fp": 37, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3833, "recall": 0.561, "f1": 0.4554, "f2": 0.5134, "f2_score": 51.3, "f3": 0.5361, "f3_score": 53.6, "tpr": 0.561, "fpr": 1.0, "youden_j": -0.439, "cvss_coverage": 1.0, "cvss_tp_weight": 154.7, "cvss_fp_weight": 222.7, "cvss_fn_weight": 112.0, "cvss_precision": 0.4099, "cvss_recall": 0.5801, "cvss_f3": 0.5569, "cvss_f3_score": 55.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 4, "precision": 1.0, "recall": 0.2 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 18, "recall": 0.561 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": "generated-legal-case-remix/app/lib/citation-preview.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-formatting.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/continuation.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/workspace.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-embed.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/draft-assist.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/message-macros.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.billing-confirmation.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 27, "fp": 48, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.36, "recall": 0.6585, "f1": 0.4655, "f2": 0.5649, "f2_score": 56.5, "f3": 0.6081, "f3_score": 60.8, "tpr": 0.6585, "fpr": 1.0, "youden_j": -0.3415, "cvss_coverage": 1.0, "cvss_tp_weight": 182.4, "cvss_fp_weight": 288.2, "cvss_fn_weight": 84.3, "cvss_precision": 0.3876, "cvss_recall": 0.6839, "cvss_f3": 0.6353, "cvss_f3_score": 63.5, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.6111 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 27, "fp": 0, "fn": 14, "recall": 0.6585 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": "generated-legal-case-remix/app/lib/citation-preview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.timeline-export.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.timeline-export.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/message-macros.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/draft-assist.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/continuation.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-843" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-311" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.billing-confirmation.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.messages.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.messages.tsx", "cwe": "CWE-285" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/workspace.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/workspace.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/delegate-coverage.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-prefs.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/server/app.ts", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/server/app.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/portal-embed.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": "generated-legal-case-remix/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/prisma/seed.ts", "cwe": "CWE-259" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 23, "fp": 25, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4792, "recall": 0.561, "f1": 0.5169, "f2": 0.5425, "f2_score": 54.2, "f3": 0.5516, "f3_score": 55.2, "tpr": 0.561, "fpr": 1.0, "youden_j": -0.439, "cvss_coverage": 1.0, "cvss_tp_weight": 146.0, "cvss_fp_weight": 162.6, "cvss_fn_weight": 120.7, "cvss_precision": 0.4731, "cvss_recall": 0.5474, "cvss_f3": 0.539, "cvss_f3_score": 53.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 3, "precision": 1.0, "recall": 0.4 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 18, "recall": 0.561 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": "generated-legal-case-remix/app/lib/audit.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/permissions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.documents._index.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.notifications.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.messages.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.billing-confirmation.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status-v2.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/portal.filing-status-widget.$matterId.tsx", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 25, "fp": 34, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4237, "recall": 0.6098, "f1": 0.5, "f2": 0.5605, "f2_score": 56.1, "f3": 0.5841, "f3_score": 58.4, "tpr": 0.6098, "fpr": 1.0, "youden_j": -0.3902, "cvss_coverage": 1.0, "cvss_tp_weight": 161.7, "cvss_fp_weight": 221.2, "cvss_fn_weight": 105.0, "cvss_precision": 0.4223, "cvss_recall": 0.6063, "cvss_f3": 0.581, "cvss_f3_score": 58.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 3, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.6 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5556 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 16, "recall": 0.6098 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/server/app.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/permissions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.documents._index.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.documents.$documentId.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.documents.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.tasks.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.deadlines.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.audit.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.edit.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.messages.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.notifications.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status-v2.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/conflict-vendor-status.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/portal.filing-status-widget.$matterId.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-311" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-319" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": "generated-legal-case-remix/app/lib/audit.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/server.js", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 37, "fp": 18, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.6727, "recall": 0.9024, "f1": 0.7708, "f2": 0.8447, "f2_score": 84.5, "f3": 0.8726, "f3_score": 87.3, "tpr": 0.9024, "fpr": 1.0, "youden_j": -0.0976, "cvss_coverage": 1.0, "cvss_tp_weight": 236.1, "cvss_fp_weight": 117.1, "cvss_fn_weight": 30.6, "cvss_precision": 0.6685, "cvss_recall": 0.8853, "cvss_f3": 0.8575, "cvss_f3_score": 85.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 4, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 17, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 4, "recall": 0.9024 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": "generated-legal-case-remix/app/lib/audit.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": "generated-legal-case-remix/app/lib/citation-preview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/staff-directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": "generated-legal-case-remix/app/routes/_app.admin.users.$userId.tsx", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-640" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": "generated-legal-case-remix/app/routes/api.billing-confirmation.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status-v2.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/permissions.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.documents._index.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.portal.messages.tsx", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.conflict-check-sync.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.intake-sync.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 41, "fp": 40, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5062, "recall": 1.0, "f1": 0.6721, "f2": 0.8367, "f2_score": 83.7, "f3": 0.9111, "f3_score": 91.1, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 266.7, "cvss_fp_weight": 304.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.4673, "cvss_recall": 1.0, "cvss_f3": 0.8977, "cvss_f3_score": 89.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 5, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": "generated-legal-case-remix/app/lib/activity-log.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": "generated-legal-case-remix/app/lib/audit.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/audit.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": "generated-legal-case-remix/app/lib/citation-preview.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": "generated-legal-case-remix/app/lib/client-verification.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": "generated-legal-case-remix/app/lib/court-filing-index.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/docket-feed-import.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": "generated-legal-case-remix/app/lib/filing-templates.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": "generated-legal-case-remix/app/lib/matter-archive.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/matter-ledger.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/message-macros.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/note-sealing.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/permissions.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/roster-provisioning.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/transcripts.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": "generated-legal-case-remix/app/lib/utils.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.admin.audit.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.admin.users.$userId.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": "generated-legal-case-remix/app/routes/_app.admin.users.$userId.tsx", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.admin.users.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.clients.$clientId.edit.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.clients.$clientId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.clients._index.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": "generated-legal-case-remix/app/routes/_app.deadlines.$deadlineId.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId._index.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.audit.tsx", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.audit.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.messages.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-1427" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters._index.tsx", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": "generated-legal-case-remix/app/routes/_app.portal.upload.tsx", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.profile.tsx", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.profile.tsx", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": "generated-legal-case-remix/app/routes/_app.tasks._index.tsx", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": "generated-legal-case-remix/app/routes/_public.forgot-password.tsx", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.login.tsx", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_public.register.tsx", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": "generated-legal-case-remix/app/routes/api.billing-confirmation.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.citation-preview-v2.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.timeline-export.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": "generated-legal-case-remix/app/routes/portal.widget.$matterId.tsx", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": "generated-legal-case-remix/app/routes/_app.tasks.$taskId.edit.tsx", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": "generated-legal-case-remix/app/lib/document-search.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": "generated-legal-case-remix/app/lib/matter-sharing.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": "generated-legal-case-remix/app/lib/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": "generated-legal-case-remix/app/lib/co-counsel-access.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": "generated-legal-case-remix/app/lib/practice-management-sync.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/docker-compose.yml", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": "generated-legal-case-remix/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.dashboard.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.dashboard.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.deadlines._index.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/_app.matters.$matterId.notes.tsx", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status-v2.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": "generated-legal-case-remix/app/routes/api.clients.$clientId.conflict-vendor-status.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.conflict-check-sync.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.intake-sync.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.risk-score.ts", "cwe": "CWE-306" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 1, "fp": 3, "fn": 40, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.25, "recall": 0.0244, "f1": 0.0444, "f2": 0.0298, "f2_score": 3.0, "f3": 0.0268, "f3_score": 2.7, "tpr": 0.0244, "fpr": 1.0, "youden_j": -0.9756, "cvss_coverage": 1.0, "cvss_tp_weight": 8.8, "cvss_fp_weight": 19.5, "cvss_fn_weight": 257.9, "cvss_precision": 0.3108, "cvss_recall": 0.033, "cvss_f3": 0.0362, "cvss_f3_score": 3.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 5, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 18, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 1, "fp": 0, "fn": 40, "recall": 0.0244 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-011", "file": "generated-legal-case-remix/app/lib/document-export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/lib/intake-sync.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.docket-summary.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "generated-legal-case-remix/app/routes/api.matters.$matterId.timeline.ts", "cwe": "CWE-346" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-001", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-002", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-003", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-004", "file": null, "cwe": "CWE-304" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-005", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-006", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-007", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-009", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-010", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-013", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-014", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-015", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-016", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-017", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-018", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-019", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-020", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-021", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-022", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-023", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-024", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-025", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-027", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-028", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-029", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-030", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-032", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-033", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-034", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-035", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-036", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-037", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-038", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-039", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-040", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-legal-case-remix-041", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 21, "fp": 16, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.5676, "recall": 0.4773, "f1": 0.5185, "f2": 0.493, "f2_score": 49.3, "f3": 0.485, "f3_score": 48.5, "tpr": 0.4773, "fpr": 1.0, "youden_j": -0.5227, "cvss_coverage": 1.0, "cvss_tp_weight": 131.6, "cvss_fp_weight": 101.4, "cvss_fn_weight": 147.3, "cvss_precision": 0.5648, "cvss_recall": 0.4719, "cvss_f3": 0.4797, "cvss_f3_score": 48.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.4737 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 21, "fp": 0, "fn": 22, "recall": 0.4884 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-502" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "backend/src/routes/workers.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-696" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "backend/src/routes/workers.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 19, "fp": 24, "fn": 25, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.4419, "recall": 0.4318, "f1": 0.4368, "f2": 0.4338, "f2_score": 43.4, "f3": 0.4328, "f3_score": 43.3, "tpr": 0.4318, "fpr": 1.0, "youden_j": -0.5682, "cvss_coverage": 1.0, "cvss_tp_weight": 119.8, "cvss_fp_weight": 146.3, "cvss_fn_weight": 159.1, "cvss_precision": 0.4502, "cvss_recall": 0.4295, "cvss_f3": 0.4315, "cvss_f3_score": 43.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 7, "fp": 0, "fn": 12, "precision": 1.0, "recall": 0.3684 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 24, "recall": 0.4419 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 44, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 278.9, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 19, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 43, "recall": 0.0 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 27, "fp": 25, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.5192, "recall": 0.6136, "f1": 0.5625, "f2": 0.5921, "f2_score": 59.2, "f3": 0.6027, "f3_score": 60.3, "tpr": 0.6136, "fpr": 1.0, "youden_j": -0.3864, "cvss_coverage": 1.0, "cvss_tp_weight": 159.1, "cvss_fp_weight": 158.5, "cvss_fn_weight": 119.8, "cvss_precision": 0.501, "cvss_recall": 0.5705, "cvss_f3": 0.5627, "cvss_f3_score": 56.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.5263 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 17, "recall": 0.6047 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-113" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-353" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "backend/src/routes/workers.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 26, "fp": 39, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.4, "recall": 0.5909, "f1": 0.4771, "f2": 0.5394, "f2_score": 53.9, "f3": 0.564, "f3_score": 56.4, "tpr": 0.5909, "fpr": 1.0, "youden_j": -0.4091, "cvss_coverage": 1.0, "cvss_tp_weight": 164.7, "cvss_fp_weight": 235.5, "cvss_fn_weight": 114.2, "cvss_precision": 0.4115, "cvss_recall": 0.5905, "cvss_f3": 0.5659, "cvss_f3_score": 56.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 8, "precision": 1.0, "recall": 0.5789 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 18, "recall": 0.5814 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-87" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/portalAccess.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": "backend/src/services/portalAccess.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/db/schema.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/db/schema.ts", "cwe": "CWE-359" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 43, "fp": 27, "fn": 1, "tn": 0, "ns": 1, "ns_gt": 7, "precision": 0.6143, "recall": 0.9773, "f1": 0.7544, "f2": 0.874, "f2_score": 87.4, "f3": 0.9227, "f3_score": 92.3, "tpr": 0.9773, "fpr": 1.0, "youden_j": -0.0227, "cvss_coverage": 1.0, "cvss_tp_weight": 273.6, "cvss_fp_weight": 171.1, "cvss_fn_weight": 5.3, "cvss_precision": 0.6152, "cvss_recall": 0.981, "cvss_f3": 0.9259, "cvss_f3_score": 92.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 42, "fp": 0, "fn": 1, "recall": 0.9767 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": "backend/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "backend/src/routes/workers.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "backend/src/routes/workers.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": "backend/src/services/portalAccess.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 27, "fp": 41, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.3971, "recall": 0.6136, "f1": 0.4821, "f2": 0.5533, "f2_score": 55.3, "f3": 0.5819, "f3_score": 58.2, "tpr": 0.6136, "fpr": 1.0, "youden_j": -0.3864, "cvss_coverage": 1.0, "cvss_tp_weight": 172.6, "cvss_fp_weight": 248.2, "cvss_fn_weight": 106.3, "cvss_precision": 0.4102, "cvss_recall": 0.6189, "cvss_f3": 0.5889, "cvss_f3_score": 58.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 1, "fp": 0, "fn": 5, "precision": 1.0, "recall": 0.1667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 6, "precision": 1.0, "recall": 0.6842 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 17, "recall": 0.6047 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/import.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-345" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/audit-logs.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-1333" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/csv.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 38, "fp": 28, "fn": 6, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.5758, "recall": 0.8636, "f1": 0.6909, "f2": 0.7851, "f2_score": 78.5, "f3": 0.8225, "f3_score": 82.3, "tpr": 0.8636, "fpr": 1.0, "youden_j": -0.1364, "cvss_coverage": 1.0, "cvss_tp_weight": 242.9, "cvss_fp_weight": 171.6, "cvss_fn_weight": 36.0, "cvss_precision": 0.5859, "cvss_recall": 0.8709, "cvss_f3": 0.8305, "cvss_f3_score": 83.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 37, "fp": 0, "fn": 6, "recall": 0.8605 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": "backend/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "backend/src/routes/workers.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": "backend/src/services/portalAccess.ts", "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 42, "fp": 43, "fn": 2, "tn": 0, "ns": 1, "ns_gt": 7, "precision": 0.4941, "recall": 0.9545, "f1": 0.6512, "f2": 0.8046, "f2_score": 80.5, "f3": 0.8732, "f3_score": 87.3, "tpr": 0.9545, "fpr": 1.0, "youden_j": -0.0455, "cvss_coverage": 1.0, "cvss_tp_weight": 269.3, "cvss_fp_weight": 331.5, "cvss_fn_weight": 9.6, "cvss_precision": 0.4482, "cvss_recall": 0.9656, "cvss_f3": 0.8657, "cvss_f3_score": 86.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 3, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 5, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.8333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 18, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9474 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 4, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 2, "recall": 0.9535 }, "medium": { "tp": 1, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": "backend/src/routes/customers.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": "backend/src/routes/customers.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": "backend/src/routes/incidents.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": "backend/src/routes/regions.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": "backend/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": "backend/src/routes/workers.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": "backend/src/routes/workers.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": "backend/src/routes/workers.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": "backend/src/routes/workers.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": "backend/src/services/carrierAuthority.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": "backend/src/services/carrierRateSync.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/notificationTemplates.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": "backend/src/routes/workers.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": "backend/src/routes/workers.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": "backend/drizzle.config.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": "backend/src/db/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": "backend/src/services/portalAccess.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": "backend/src/routes/regions.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": "backend/src/routes/routes.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 79, "fn": 35, "tn": 0, "ns": 0, "ns_gt": 7, "precision": 0.1023, "recall": 0.2045, "f1": 0.1364, "f2": 0.1705, "f2_score": 17.0, "f3": 0.186, "f3_score": 18.6, "tpr": 0.2045, "fpr": 1.0, "youden_j": -0.7955, "cvss_coverage": 1.0, "cvss_tp_weight": 61.5, "cvss_fp_weight": 498.1, "cvss_fn_weight": 217.4, "cvss_precision": 0.1099, "cvss_recall": 0.2205, "cvss_f3": 0.2003, "cvss_f3_score": 20.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "missing_auth": { "label": "Missing Authentication / Authorization", "tp": 0, "fp": 0, "fn": 6, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.1579 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 4, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 34, "recall": 0.2093 }, "medium": { "tp": 0, "fp": 0, "fn": 1, "recall": 0.0 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-002", "file": "backend/src/db/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-016", "file": "backend/src/routes/customers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/customers.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-017", "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-018", "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/export.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/incidents.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/jobs.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-021", "file": "backend/src/routes/jobs.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/proof-uploads.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/routes.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-035", "file": "backend/src/routes/service-types.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-346" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-036", "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tracking.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-039", "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-310" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-046", "file": "backend/src/routes/workers.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/workers.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/carrierManifest.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/serviceDocsIndex.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/webhook.ts", "cwe": "CWE-134" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-732" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-003", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-011", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-012", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-013", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-014", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-015", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-019", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-020", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-022", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-023", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-024", "file": null, "cwe": "CWE-352" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-025", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-026", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-027", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-028", "file": null, "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-029", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-030", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-031", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-032", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-033", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-034", "file": null, "cwe": "CWE-306" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-037", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-038", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-040", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-041", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-042", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-043", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-044", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-045", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-047", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-048", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-049", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-050", "file": null, "cwe": "CWE-1336" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-051", "file": null, "cwe": "CWE-321" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-004", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-005", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-006", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-007", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-008", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-009", "file": null, "cwe": "CWE-798" }, { "classification": "NS", "ground_truth_id": "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue-010", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-marketplace-commerce-express": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 19, "fp": 18, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5135, "recall": 0.4419, "f1": 0.475, "f2": 0.4545, "f2_score": 45.5, "f3": 0.4481, "f3_score": 44.8, "tpr": 0.4419, "fpr": 1.0, "youden_j": -0.5581, "cvss_coverage": 1.0, "cvss_tp_weight": 126.0, "cvss_fp_weight": 88.8, "cvss_fn_weight": 140.7, "cvss_precision": 0.5865, "cvss_recall": 0.4724, "cvss_f3": 0.4818, "cvss_f3_score": 48.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 18, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 24, "recall": 0.4419 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auditLogs.ts", "cwe": "CWE-943" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-522" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 17, "fp": 26, "fn": 26, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3953, "recall": 0.3953, "f1": 0.3953, "f2": 0.3953, "f2_score": 39.5, "f3": 0.3953, "f3_score": 39.5, "tpr": 0.3953, "fpr": 1.0, "youden_j": -0.6047, "cvss_coverage": 1.0, "cvss_tp_weight": 109.7, "cvss_fp_weight": 149.9, "cvss_fn_weight": 157.0, "cvss_precision": 0.4226, "cvss_recall": 0.4113, "cvss_f3": 0.4124, "cvss_f3_score": 41.2, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.2963 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 26, "recall": 0.3953 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 43, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 266.7, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 27, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 43, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": null, "cwe": "CWE-79" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 25, "fp": 20, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5556, "recall": 0.5814, "f1": 0.5682, "f2": 0.576, "f2_score": 57.6, "f3": 0.5787, "f3_score": 57.9, "tpr": 0.5814, "fpr": 1.0, "youden_j": -0.4186, "cvss_coverage": 1.0, "cvss_tp_weight": 160.7, "cvss_fp_weight": 124.0, "cvss_fn_weight": 106.0, "cvss_precision": 0.5644, "cvss_recall": 0.6025, "cvss_f3": 0.5985, "cvss_f3_score": 59.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 13, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.4815 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 25, "fp": 0, "fn": 18, "recall": 0.5814 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auditLogs.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-598" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 23, "fp": 39, "fn": 20, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.371, "recall": 0.5349, "f1": 0.4381, "f2": 0.4915, "f2_score": 49.1, "f3": 0.5122, "f3_score": 51.2, "tpr": 0.5349, "fpr": 1.0, "youden_j": -0.4651, "cvss_coverage": 1.0, "cvss_tp_weight": 149.6, "cvss_fp_weight": 230.5, "cvss_fn_weight": 117.1, "cvss_precision": 0.3936, "cvss_recall": 0.5609, "cvss_f3": 0.5381, "cvss_f3_score": 53.8, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 12, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.4444 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 23, "fp": 0, "fn": 20, "recall": 0.5349 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": "backend/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-326" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auditLogs.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 26, "fp": 29, "fn": 17, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4727, "recall": 0.6047, "f1": 0.5306, "f2": 0.5727, "f2_score": 57.3, "f3": 0.5882, "f3_score": 58.8, "tpr": 0.6047, "fpr": 1.0, "youden_j": -0.3953, "cvss_coverage": 1.0, "cvss_tp_weight": 178.7, "cvss_fp_weight": 157.1, "cvss_fn_weight": 88.0, "cvss_precision": 0.5322, "cvss_recall": 0.67, "cvss_f3": 0.6531, "cvss_f3_score": 65.3, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.5185 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 26, "fp": 0, "fn": 17, "recall": 0.6047 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": "backend/src/utils/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-290" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/imports.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 19, "fp": 40, "fn": 24, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.322, "recall": 0.4419, "f1": 0.3725, "f2": 0.4113, "f2_score": 41.1, "f3": 0.426, "f3_score": 42.6, "tpr": 0.4419, "fpr": 1.0, "youden_j": -0.5581, "cvss_coverage": 1.0, "cvss_tp_weight": 135.5, "cvss_fp_weight": 236.7, "cvss_fn_weight": 131.2, "cvss_precision": 0.3641, "cvss_recall": 0.5081, "cvss_f3": 0.4887, "cvss_f3_score": 48.9, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 11, "fp": 0, "fn": 16, "precision": 1.0, "recall": 0.4074 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 24, "recall": 0.4419 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": "backend/src/utils/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-23" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": "backend/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-359" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/imports.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-834" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-401" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-248" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-367" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-1284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/pages/UserManagementPage.tsx", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 39, "fp": 45, "fn": 4, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4643, "recall": 0.907, "f1": 0.6142, "f2": 0.7617, "f2_score": 76.2, "f3": 0.828, "f3_score": 82.8, "tpr": 0.907, "fpr": 1.0, "youden_j": -0.093, "cvss_coverage": 1.0, "cvss_tp_weight": 242.7, "cvss_fp_weight": 256.3, "cvss_fn_weight": 24.0, "cvss_precision": 0.4864, "cvss_recall": 0.91, "cvss_f3": 0.8371, "cvss_f3_score": 83.7, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.3333 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 25, "fp": 0, "fn": 2, "precision": 1.0, "recall": 0.9259 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 39, "fp": 0, "fn": 4, "recall": 0.907 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/hooks/useAuth.tsx", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": "backend/src/utils/auth.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/imports.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": "backend/src/routes/orders.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/shipmentTrackingIndex.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": "backend/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/webhookDelivery.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/upload.ts", "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 41, "fp": 61, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.402, "recall": 0.9535, "f1": 0.5655, "f2": 0.7482, "f2_score": 74.8, "f3": 0.8384, "f3_score": 83.8, "tpr": 0.9535, "fpr": 1.0, "youden_j": -0.0465, "cvss_coverage": 1.0, "cvss_tp_weight": 254.5, "cvss_fp_weight": 445.5, "cvss_fn_weight": 12.2, "cvss_precision": 0.3636, "cvss_recall": 0.9543, "cvss_f3": 0.8209, "cvss_f3_score": 82.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.6667 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 26, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.963 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 41, "fp": 0, "fn": 2, "recall": 0.9535 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-1321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": "backend/src/routes/exports.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": "backend/src/routes/imports.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/imports.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": "backend/src/routes/orders.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": "backend/src/routes/orders.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": "backend/src/routes/orders.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-352" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-352" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/activityLogger.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": "backend/src/routes/imports.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": "backend/src/routes/reviews.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": "backend/src/routes/users.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/auth.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": "backend/src/routes/products.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-20" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": "backend/src/routes/payouts.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": "backend/src/utils/auth.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": "prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 9, "fp": 95, "fn": 34, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0865, "recall": 0.2093, "f1": 0.1224, "f2": 0.163, "f2_score": 16.3, "f3": 0.1833, "f3_score": 18.3, "tpr": 0.2093, "fpr": 1.0, "youden_j": -0.7907, "cvss_coverage": 1.0, "cvss_tp_weight": 59.0, "cvss_fp_weight": 480.9, "cvss_fn_weight": 207.7, "cvss_precision": 0.1093, "cvss_recall": 0.2212, "cvss_f3": 0.2007, "cvss_f3_score": 20.1, "per_family": { "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 3, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 25, "precision": 1.0, "recall": 0.0741 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xpath_injection": { "label": "XPath Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xss": { "label": "Cross-Site Scripting", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 34, "recall": 0.2093 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/apiKeys.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1275" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-010", "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/disputes.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-014", "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/exports.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/files.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/orders.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payouts.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/products.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/reviews.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-030", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-031", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-346" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-1275" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-035", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/vendors.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-036", "file": "backend/src/routes/vendors.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-039", "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/webhooks.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/carrierProfileReader.ts", "cwe": "CWE-1333" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/utils/directoryClient.ts", "cwe": "CWE-1333" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-001", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-002", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-003", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-006", "file": null, "cwe": "CWE-1321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-007", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-008", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-009", "file": null, "cwe": "CWE-20" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-011", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-012", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-013", "file": null, "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-015", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-017", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-018", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-019", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-020", "file": null, "cwe": "CWE-643" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-021", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-022", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-023", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-024", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-025", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-027", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-028", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-029", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-032", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-033", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-034", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-037", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-038", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-040", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-041", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-042", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-marketplace-commerce-express-043", "file": null, "cwe": "CWE-798" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-property-management-fastify-vue": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 9, "fp": 12, "fn": 23, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4286, "recall": 0.2812, "f1": 0.3396, "f2": 0.302, "f2_score": 30.2, "f3": 0.2913, "f3_score": 29.1, "tpr": 0.2812, "fpr": 1.0, "youden_j": -0.7188, "cvss_coverage": 1.0, "cvss_tp_weight": 65.5, "cvss_fp_weight": 68.8, "cvss_fn_weight": 133.3, "cvss_precision": 0.4876, "cvss_recall": 0.3295, "cvss_f3": 0.3405, "cvss_f3_score": 34.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 3, "fp": 0, "fn": 17, "precision": 1.0, "recall": 0.15 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 9, "fp": 0, "fn": 23, "recall": 0.2812 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-330" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 13, "fp": 31, "fn": 19, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2955, "recall": 0.4062, "f1": 0.3421, "f2": 0.3779, "f2_score": 37.8, "f3": 0.3916, "f3_score": 39.2, "tpr": 0.4062, "fpr": 1.0, "youden_j": -0.5938, "cvss_coverage": 1.0, "cvss_tp_weight": 95.2, "cvss_fp_weight": 175.5, "cvss_fn_weight": 103.6, "cvss_precision": 0.3517, "cvss_recall": 0.4789, "cvss_f3": 0.4622, "cvss_f3_score": 46.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 15, "precision": 1.0, "recall": 0.25 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 13, "fp": 0, "fn": 19, "recall": 0.4062 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-1188" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 198.8, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 20, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 32, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-330" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 18, "fp": 30, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.375, "recall": 0.5625, "f1": 0.45, "f2": 0.5114, "f2_score": 51.1, "f3": 0.5357, "f3_score": 53.6, "tpr": 0.5625, "fpr": 1.0, "youden_j": -0.4375, "cvss_coverage": 1.0, "cvss_tp_weight": 117.7, "cvss_fp_weight": 186.4, "cvss_fn_weight": 81.1, "cvss_precision": 0.3871, "cvss_recall": 0.5921, "cvss_f3": 0.5623, "cvss_f3_score": 56.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 14, "recall": 0.5625 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-697" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/dataProtection.ts", "cwe": "CWE-649" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/replyAssistant.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-565" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 19, "fp": 40, "fn": 13, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.322, "recall": 0.5938, "f1": 0.4176, "f2": 0.508, "f2_score": 50.8, "f3": 0.5476, "f3_score": 54.8, "tpr": 0.5938, "fpr": 1.0, "youden_j": -0.4062, "cvss_coverage": 1.0, "cvss_tp_weight": 130.3, "cvss_fp_weight": 208.5, "cvss_fn_weight": 68.5, "cvss_precision": 0.3846, "cvss_recall": 0.6554, "cvss_f3": 0.6123, "cvss_f3_score": 61.2, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 9, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.45 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 19, "fp": 0, "fn": 13, "recall": 0.5938 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-776" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-538" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-306" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-79" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/routes/units.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/browsingSession.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": "backend/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/replyAssistant.ts", "cwe": "CWE-1427" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 31, "fp": 26, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5439, "recall": 0.9688, "f1": 0.6966, "f2": 0.8378, "f2_score": 83.8, "f3": 0.8986, "f3_score": 89.9, "tpr": 0.9688, "fpr": 1.0, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 194.5, "cvss_fp_weight": 161.5, "cvss_fn_weight": 4.3, "cvss_precision": 0.5463, "cvss_recall": 0.9784, "cvss_f3": 0.9067, "cvss_f3_score": 90.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.95 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 1, "recall": 0.9688 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/leases.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/messages.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/routes/units.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": "backend/src/routes/units.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": "backend/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 20, "fp": 56, "fn": 12, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2632, "recall": 0.625, "f1": 0.3704, "f2": 0.4902, "f2_score": 49.0, "f3": 0.5495, "f3_score": 54.9, "tpr": 0.625, "fpr": 1.0, "youden_j": -0.375, "cvss_coverage": 1.0, "cvss_tp_weight": 134.0, "cvss_fp_weight": 336.5, "cvss_fn_weight": 64.8, "cvss_precision": 0.2848, "cvss_recall": 0.674, "cvss_f3": 0.593, "cvss_f3_score": 59.3, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 10, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.5 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 20, "fp": 0, "fn": 12, "recall": 0.625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/middleware/auth.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": "backend/src/routes/units.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-863" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-384" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/routes/units.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-598" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": "backend/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 30, "fp": 30, "fn": 2, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.5, "recall": 0.9375, "f1": 0.6522, "f2": 0.7979, "f2_score": 79.8, "f3": 0.8621, "f3_score": 86.2, "tpr": 0.9375, "fpr": 1.0, "youden_j": -0.0625, "cvss_coverage": 1.0, "cvss_tp_weight": 185.4, "cvss_fp_weight": 186.4, "cvss_fn_weight": 13.4, "cvss_precision": 0.4987, "cvss_recall": 0.9326, "cvss_f3": 0.8579, "cvss_f3_score": 85.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.95 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 30, "fp": 0, "fn": 2, "recall": 0.9375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": "backend/src/middleware/auth.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/leases.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/messages.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/routes/units.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": "backend/src/routes/units.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/directory.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dashboard.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-1236" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 31, "fp": 54, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3647, "recall": 0.9688, "f1": 0.5299, "f2": 0.7277, "f2_score": 72.8, "f3": 0.8311, "f3_score": 83.1, "tpr": 0.9688, "fpr": 1.0, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 196.1, "cvss_fp_weight": 405.0, "cvss_fn_weight": 2.7, "cvss_precision": 0.3262, "cvss_recall": 0.9864, "cvss_f3": 0.8204, "cvss_f3_score": 82.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 19, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.95 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 1, "recall": 0.9688 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/index.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": "backend/src/routes/auth.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/buildings.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": "backend/src/routes/documents.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": "backend/src/routes/documents.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": "backend/src/routes/leases.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": "backend/src/routes/leases.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": "backend/src/routes/leases.ts", "cwe": "CWE-312" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": "backend/src/routes/leases.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-1336" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": "backend/src/routes/payments.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/payments.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": "backend/src/routes/properties.ts", "cwe": "CWE-489" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": "backend/src/routes/units.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": "backend/src/routes/units.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/units.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": "backend/src/routes/users.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": "backend/src/services/activityLog.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/dataProtection.ts", "cwe": "CWE-327" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": "backend/src/services/directory.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": "backend/src/routes/notifications.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": "backend/src/routes/units.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": "backend/src/services/portalAccessCodes.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": "backend/src/routes/auth.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/users.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/browsingSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/browsingSession.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/auth.ts", "cwe": "CWE-304" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": "backend/src/routes/messages.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/properties.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": "backend/src/routes/tickets.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/buildingAccess.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/buildingAccess.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/buildingAccess.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/buildingAccess.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": "backend/src/index.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": "backend/src/routes/leases.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": "backend/src/routes/payments.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": "backend/src/seeds/seed.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "docker-compose.yml", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-862" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 39, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1136, "recall": 0.1562, "f1": 0.1316, "f2": 0.1453, "f2_score": 14.5, "f3": 0.1506, "f3_score": 15.1, "tpr": 0.1562, "fpr": 1.0, "youden_j": -0.8438, "cvss_coverage": 1.0, "cvss_tp_weight": 34.3, "cvss_fp_weight": 242.3, "cvss_fn_weight": 164.5, "cvss_precision": 0.124, "cvss_recall": 0.1725, "cvss_f3": 0.166, "cvss_f3_score": 16.6, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 19, "precision": 1.0, "recall": 0.05 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 27, "recall": 0.1562 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-007", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-008", "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/dispatch.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-010", "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/documents.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-012", "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/importExport.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/inspections.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/leases.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-018", "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/messages.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/notifications.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/routes/tickets.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/dataProtection.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/services/dataProtection.ts", "cwe": "CWE-327" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-001", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-002", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-003", "file": null, "cwe": "CWE-204" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-004", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-005", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-006", "file": null, "cwe": "CWE-347" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-009", "file": null, "cwe": "CWE-434" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-011", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-013", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-014", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-015", "file": null, "cwe": "CWE-841" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-016", "file": null, "cwe": "CWE-312" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-019", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-020", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-021", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-022", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-023", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-024", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-025", "file": null, "cwe": "CWE-523" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-026", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-027", "file": null, "cwe": "CWE-203" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-028", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-029", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-030", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-031", "file": null, "cwe": "CWE-90" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-property-management-fastify-vue-032", "file": null, "cwe": "CWE-330" } ] }, "sonarqube": null }, "vc-kimi-code-seeded-v3-support-desk-nestjs-angular": { "claude-opus-5-cc-agentic-v1": null, "claude-sonnet-5-cc-agentic-v1": { "scanner": "claude-sonnet-5-cc-agentic-v1", "tp": 14, "fp": 15, "fn": 18, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4828, "recall": 0.4375, "f1": 0.459, "f2": 0.4459, "f2_score": 44.6, "f3": 0.4416, "f3_score": 44.2, "tpr": 0.4375, "fpr": 1.0, "youden_j": -0.5625, "cvss_coverage": 1.0, "cvss_tp_weight": 83.3, "cvss_fp_weight": 90.0, "cvss_fn_weight": 108.8, "cvss_precision": 0.4805, "cvss_recall": 0.4336, "cvss_f3": 0.4379, "cvss_f3_score": 43.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 4, "fp": 0, "fn": 11, "precision": 1.0, "recall": 0.2667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 14, "fp": 0, "fn": 18, "recall": 0.4375 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-384" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.controller.ts", "cwe": "CWE-290" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/widget/widget.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/widget/widget.controller.ts", "cwe": "CWE-1021" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-598" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-flash-agentic-v1": { "scanner": "deepseek-v4-flash-agentic-v1", "tp": 11, "fp": 13, "fn": 21, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4583, "recall": 0.3438, "f1": 0.3929, "f2": 0.3618, "f2_score": 36.2, "f3": 0.3526, "f3_score": 35.3, "tpr": 0.3438, "fpr": 1.0, "youden_j": -0.6562, "cvss_coverage": 1.0, "cvss_tp_weight": 68.7, "cvss_fp_weight": 67.0, "cvss_fn_weight": 123.4, "cvss_precision": 0.5061, "cvss_recall": 0.3576, "cvss_f3": 0.3684, "cvss_f3_score": 36.8, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 2, "fp": 0, "fn": 13, "precision": 1.0, "recall": 0.1333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 11, "fp": 0, "fn": 21, "recall": 0.3438 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-347" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4-pro-agentic-v1": { "scanner": "deepseek-v4-pro-agentic-v1", "tp": 0, "fp": 0, "fn": 32, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.0, "recall": 0.0, "f1": 0.0, "f2": 0.0, "f2_score": 0.0, "f3": 0.0, "f3_score": 0.0, "tpr": 0.0, "fpr": 0.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 0.0, "cvss_fp_weight": 0.0, "cvss_fn_weight": 192.1, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3": 0.0, "cvss_f3_score": 0.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 0, "fp": 0, "fn": 15, "precision": 0.0, "recall": 0.0 }, "path_traversal": { "label": "Path Traversal", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 0, "fp": 0, "fn": 32, "recall": 0.0 } }, "details": [ { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": null, "cwe": "CWE-22" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": null, "cwe": "CWE-78" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": null, "cwe": "CWE-73" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": null, "cwe": "CWE-94" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-523" } ] }, "deepseek-v4.1-flash-agentic-v1": { "scanner": "deepseek-v4.1-flash-agentic-v1", "tp": 17, "fp": 30, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3617, "recall": 0.5312, "f1": 0.4304, "f2": 0.4857, "f2_score": 48.6, "f3": 0.5075, "f3_score": 50.7, "tpr": 0.5312, "fpr": 1.0, "youden_j": -0.4688, "cvss_coverage": 1.0, "cvss_tp_weight": 100.2, "cvss_fp_weight": 169.1, "cvss_fn_weight": 91.9, "cvss_precision": 0.3721, "cvss_recall": 0.5216, "cvss_f3": 0.5015, "cvss_f3_score": 50.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 15, "recall": 0.5312 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-502" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/categories/categories.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-284" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-338" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-209" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/widget/widget.controller.ts", "cwe": "CWE-942" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-338" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-1426" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" } ] }, "gemini-3.5-flash-agentic-v1": null, "gemma4-31b-agentic-v1": null, "glm-5-agentic-v1": null, "glm-5.1-agentic-v1": null, "glm-5.2-agentic-v1": null, "glm-5.3-agentic-v1": { "scanner": "glm-5.3-agentic-v1", "tp": 17, "fp": 48, "fn": 15, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.2615, "recall": 0.5312, "f1": 0.3505, "f2": 0.4404, "f2_score": 44.0, "f3": 0.4816, "f3_score": 48.2, "tpr": 0.5312, "fpr": 1.0, "youden_j": -0.4688, "cvss_coverage": 1.0, "cvss_tp_weight": 96.8, "cvss_fp_weight": 277.1, "cvss_fn_weight": 95.3, "cvss_precision": 0.2589, "cvss_recall": 0.5039, "cvss_f3": 0.4603, "cvss_f3_score": 46.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 6, "fp": 0, "fn": 9, "precision": 1.0, "recall": 0.4 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 17, "fp": 0, "fn": 15, "recall": 0.5312 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-643" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-113" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-943" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-269" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-602" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-339" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-306" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/widget/widget.controller.ts", "cwe": "CWE-942" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/widget/widget.controller.ts", "cwe": "CWE-1021" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/categories/categories.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-259" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/features/knowledge-base/kb-detail.component.ts", "cwe": "CWE-79" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-74" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-331" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-284" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-620" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.5-agentic-v1": null, "gpt-5.6-luna-codex-cli": null, "gpt-5.6-sol-codex-cli": { "scanner": "gpt-5.6-sol-codex-cli", "tp": 31, "fp": 33, "fn": 1, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4844, "recall": 0.9688, "f1": 0.6458, "f2": 0.8073, "f2_score": 80.7, "f3": 0.8807, "f3_score": 88.1, "tpr": 0.9688, "fpr": 1.0, "youden_j": -0.0312, "cvss_coverage": 1.0, "cvss_tp_weight": 185.6, "cvss_fp_weight": 198.1, "cvss_fn_weight": 6.5, "cvss_precision": 0.4837, "cvss_recall": 0.9662, "cvss_f3": 0.8785, "cvss_f3_score": 87.9, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 14, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.9333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 31, "fp": 0, "fn": 1, "recall": 0.9688 } }, "details": [ { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-1392" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-94" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-620" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-203" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "frontend/src/app/core/services/auth.service.ts", "cwe": "CWE-922" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" } ] }, "gpt-5.6-terra-codex-cli": null, "gpt-6-astra-codex-cli": { "scanner": "gpt-6-astra-codex-cli", "tp": 18, "fp": 28, "fn": 14, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3913, "recall": 0.5625, "f1": 0.4615, "f2": 0.5172, "f2_score": 51.7, "f3": 0.5389, "f3_score": 53.9, "tpr": 0.5625, "fpr": 1.0, "youden_j": -0.4375, "cvss_coverage": 1.0, "cvss_tp_weight": 109.8, "cvss_fp_weight": 168.1, "cvss_fn_weight": 82.3, "cvss_precision": 0.3951, "cvss_recall": 0.5716, "cvss_f3": 0.5471, "cvss_f3_score": 54.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 8, "fp": 0, "fn": 7, "precision": 1.0, "recall": 0.5333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 18, "fp": 0, "fn": 14, "recall": 0.5625 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-521" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-620" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-201" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-201" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-863" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/succession-change-guard.ts", "cwe": "CWE-287" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" } ] }, "gpt-daybreak-blue-codex-cli": { "scanner": "gpt-daybreak-blue-codex-cli", "tp": 16, "fp": 30, "fn": 16, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.3478, "recall": 0.5, "f1": 0.4103, "f2": 0.4598, "f2_score": 46.0, "f3": 0.479, "f3_score": 47.9, "tpr": 0.5, "fpr": 1.0, "youden_j": -0.5, "cvss_coverage": 1.0, "cvss_tp_weight": 94.3, "cvss_fp_weight": 180.1, "cvss_fn_weight": 97.8, "cvss_precision": 0.3437, "cvss_recall": 0.4909, "cvss_f3": 0.4707, "cvss_f3_score": 47.1, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 5, "fp": 0, "fn": 10, "precision": 1.0, "recall": 0.3333 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 1, "fp": 0, "fn": 1, "precision": 1.0, "recall": 0.5 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 16, "fp": 0, "fn": 16, "recall": 0.5 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-307" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-204" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/succession-change-guard.ts", "cwe": "CWE-287" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/directory/directory.service.ts", "cwe": "CWE-90" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-770" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-345" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-1236" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-798" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-312" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-918" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-770" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-209" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-862" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-602" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-269" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-319" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-915" } ] }, "kimi-k2.5-agentic-v1": null, "kimi-k2.6-agentic-v1": null, "kimi-k2.7-agentic-v1": null, "kimi-k3-agentic-v1": null, "kolega-ca-cc-sonnet": null, "kolega-claude-adaptation": null, "kolega-claude-adaptation-deepseek-only": null, "kolega-claude-adaptation-v1": null, "kolega-devsec-core-v0.0.1": null, "kolega-devsec-max-v0.1.0": { "scanner": "kolega-devsec-max-v0.1.0", "tp": 32, "fp": 42, "fn": 0, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.4324, "recall": 1.0, "f1": 0.6038, "f2": 0.7921, "f2_score": 79.2, "f3": 0.884, "f3_score": 88.4, "tpr": 1.0, "fpr": 1.0, "youden_j": 0.0, "cvss_coverage": 1.0, "cvss_tp_weight": 192.1, "cvss_fp_weight": 314.0, "cvss_fn_weight": 0.0, "cvss_precision": 0.3796, "cvss_recall": 1.0, "cvss_f3": 0.8595, "cvss_f3_score": 86.0, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "open_redirect": { "label": "Open Redirect", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "other": { "label": "Other", "tp": 15, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "sql_injection": { "label": "SQL Injection", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "xxe": { "label": "XML External Entities", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 } }, "per_severity": { "high": { "tp": 32, "fp": 0, "fn": 0, "recall": 1.0 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.controller.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-918" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-434" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-203" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-307" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-916" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-613" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-89" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-601" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-117" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-639" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-73" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": "backend/src/knowledge-base/knowledge-base.service.ts", "cwe": "CWE-611" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-347" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-1336" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-73" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-94" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-489" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-639" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": "backend/src/users/users.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": "backend/src/users/users.service.ts", "cwe": "CWE-532" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": "backend/src/users/users.service.ts", "cwe": "CWE-778" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-523" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-200" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": "backend/src/users/users.service.ts", "cwe": "CWE-915" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": "backend/src/auth/workbench-session.store.ts", "cwe": "CWE-330" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-614" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-1004" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-330" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-200" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": "backend/src/auth/auth.service.ts", "cwe": "CWE-613" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/audit/audit.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/dashboard/dashboard.service.ts", "cwe": "CWE-400" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/webhooks/webhooks.service.ts", "cwe": "CWE-807" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": "backend/prisma/seed.ts", "cwe": "CWE-798" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": "backend/src/auth/auth.module.ts", "cwe": "CWE-321" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": "backend/src/auth/jwt.strategy.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.service.ts", "cwe": "CWE-841" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": "backend/src/notifications/notifications.service.ts", "cwe": "CWE-321" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-841" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.controller.ts", "cwe": "CWE-862" } ] }, "kolega-original-claude-adaptation-deepseek-v4-pro": null, "kolega-v0.0.2-raw": null, "minimax-m2.7-agentic-v1": null, "ornith-q3-agentic-v1": null, "qwen3.6-35b-agentic-v1": null, "rowan": null, "semgrep": { "scanner": "semgrep", "tp": 5, "fp": 27, "fn": 27, "tn": 0, "ns": 0, "ns_gt": 0, "precision": 0.1562, "recall": 0.1562, "f1": 0.1562, "f2": 0.1562, "f2_score": 15.6, "f3": 0.1562, "f3_score": 15.6, "tpr": 0.1562, "fpr": 1.0, "youden_j": -0.8438, "cvss_coverage": 1.0, "cvss_tp_weight": 37.8, "cvss_fp_weight": 156.6, "cvss_fn_weight": 154.3, "cvss_precision": 0.1945, "cvss_recall": 0.1968, "cvss_f3": 0.1965, "cvss_f3_score": 19.7, "per_family": { "broken_access_control": { "label": "Broken Access Control / IDOR", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "code_injection": { "label": "Code Injection / RFI", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "command_injection": { "label": "Command / OS Injection", "tp": 2, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "denial_of_service": { "label": "Denial of Service", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "hardcoded_credentials": { "label": "Hardcoded Credentials", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "open_redirect": { "label": "Open Redirect", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "other": { "label": "Other", "tp": 1, "fp": 0, "fn": 14, "precision": 1.0, "recall": 0.0667 }, "path_traversal": { "label": "Path Traversal", "tp": 1, "fp": 0, "fn": 0, "precision": 1.0, "recall": 1.0 }, "security_misconfiguration": { "label": "Security Misconfiguration", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sensitive_data_exposure": { "label": "Sensitive Data Exposure", "tp": 0, "fp": 0, "fn": 2, "precision": 0.0, "recall": 0.0 }, "sql_injection": { "label": "SQL Injection", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "ssrf": { "label": "Server-Side Request Forgery", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 }, "xxe": { "label": "XML External Entities", "tp": 0, "fp": 0, "fn": 1, "precision": 0.0, "recall": 0.0 } }, "per_severity": { "high": { "tp": 5, "fp": 0, "fn": 27, "recall": 0.1562 } }, "details": [ { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-327" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-004", "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/attachments/attachments.service.ts", "cwe": "CWE-310" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/auth/auth.controller.ts", "cwe": "CWE-614" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/escalations/escalations.controller.ts", "cwe": "CWE-732" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-018", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-019", "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/exports/exports.service.ts", "cwe": "CWE-78" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/imports/imports.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/internal-notes/internal-notes.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-022", "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/replies/replies.service.ts", "cwe": "CWE-22" }, { "classification": "TP", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-023", "file": "backend/src/sla-policies/sla-policies.service.ts", "cwe": "CWE-95" }, { "classification": "FP", "ground_truth_id": null, "file": "backend/src/tickets/tickets.service.ts", "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-001", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-002", "file": null, "cwe": "CWE-798" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-003", "file": null, "cwe": "CWE-918" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-005", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-006", "file": null, "cwe": "CWE-307" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-007", "file": null, "cwe": "CWE-916" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-008", "file": null, "cwe": "CWE-613" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-009", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-010", "file": null, "cwe": "CWE-330" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-011", "file": null, "cwe": "CWE-89" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-012", "file": null, "cwe": "CWE-400" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-013", "file": null, "cwe": "CWE-1004" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-014", "file": null, "cwe": "CWE-614" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-015", "file": null, "cwe": "CWE-601" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-016", "file": null, "cwe": "CWE-117" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-017", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-020", "file": null, "cwe": "CWE-611" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-021", "file": null, "cwe": "CWE-321" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-024", "file": null, "cwe": "CWE-489" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-025", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-026", "file": null, "cwe": "CWE-639" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-027", "file": null, "cwe": "CWE-807" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-028", "file": null, "cwe": "CWE-200" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-029", "file": null, "cwe": "CWE-532" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-030", "file": null, "cwe": "CWE-778" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-031", "file": null, "cwe": "CWE-915" }, { "classification": "FN", "ground_truth_id": "vc-kimi-code-seeded-v3-support-desk-nestjs-angular-032", "file": null, "cwe": "CWE-523" } ] }, "sonarqube": null } }, "aggregates": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 1301, "fp": 799, "fn": 601, "tn": 274, "precision": 0.6195, "recall": 0.684, "f2_score": 67.0, "f3_score": 67.7, "cvss_precision": 0.6729, "cvss_recall": 0.7047, "cvss_f3_score": 70.1 }, "strict_micro": { "tp": 1301, "fp": 799, "fn": 2837, "tn": 274, "precision": 0.6195, "recall": 0.3144, "f2_score": 34.9, "f3_score": 33.1, "cvss_precision": 0.6729, "cvss_recall": 0.3162, "cvss_f3_score": 33.4 }, "macro": { "f2_score": 68.4 }, "per_severity": { "critical": { "tp": 145, "fp": 2, "fn": 9 }, "high": { "tp": 524, "fp": 2, "fn": 228 }, "low": { "tp": 53, "fp": 0, "fn": 33 }, "medium": { "tp": 579, "fp": 2, "fn": 331 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 11.8, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 90.6769, "successful_runs": 66, "cost_per_run": 1.3739, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0678 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 1758, "fp": 1581, "fn": 2380, "tn": 275, "precision": 0.5265, "recall": 0.4248, "f2_score": 44.2, "f3_score": 43.3, "cvss_precision": 0.5749, "cvss_recall": 0.4486, "cvss_f3_score": 45.9 }, "strict_micro": { "tp": 1758, "fp": 1581, "fn": 2380, "tn": 275, "precision": 0.5265, "recall": 0.4248, "f2_score": 44.2, "f3_score": 43.3, "cvss_precision": 0.5749, "cvss_recall": 0.4486, "cvss_f3_score": 45.9 }, "macro": { "f2_score": 45.4 }, "per_severity": { "critical": { "tp": 140, "fp": 1, "fn": 18 }, "high": { "tp": 1181, "fp": 1, "fn": 1667 }, "low": { "tp": 34, "fp": 0, "fn": 132 }, "medium": { "tp": 403, "fp": 3, "fn": 563 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 17.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 130.668, "successful_runs": 140, "cost_per_run": 0.9333, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0176 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 1683, "fp": 1306, "fn": 2455, "tn": 272, "precision": 0.5631, "recall": 0.4067, "f2_score": 43.1, "f3_score": 41.8, "cvss_precision": 0.613, "cvss_recall": 0.4315, "cvss_f3_score": 44.5 }, "strict_micro": { "tp": 1683, "fp": 1306, "fn": 2455, "tn": 272, "precision": 0.5631, "recall": 0.4067, "f2_score": 43.1, "f3_score": 41.8, "cvss_precision": 0.613, "cvss_recall": 0.4315, "cvss_f3_score": 44.5 }, "macro": { "f2_score": 45.5 }, "per_severity": { "critical": { "tp": 147, "fp": 0, "fn": 11 }, "high": { "tp": 1105, "fp": 1, "fn": 1743 }, "low": { "tp": 49, "fp": 2, "fn": 117 }, "medium": { "tp": 379, "fp": 3, "fn": 587 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 18.0, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 3.8336, "successful_runs": 188, "cost_per_run": 0.0204, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0005 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 1507, "fp": 967, "fn": 2630, "tn": 275, "precision": 0.6091, "recall": 0.3643, "f2_score": 39.6, "f3_score": 38.0, "cvss_precision": 0.6686, "cvss_recall": 0.3875, "cvss_f3_score": 40.4 }, "strict_micro": { "tp": 1507, "fp": 967, "fn": 2630, "tn": 275, "precision": 0.6091, "recall": 0.3643, "f2_score": 39.6, "f3_score": 38.0, "cvss_precision": 0.6686, "cvss_recall": 0.3875, "cvss_f3_score": 40.4 }, "macro": { "f2_score": 40.8 }, "per_severity": { "critical": { "tp": 140, "fp": 2, "fn": 18 }, "high": { "tp": 968, "fp": 1, "fn": 1880 }, "low": { "tp": 43, "fp": 0, "fn": 123 }, "medium": { "tp": 359, "fp": 2, "fn": 607 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 20.6, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 15.0775, "successful_runs": 185, "cost_per_run": 0.0815, "total_loc_scanned": 741034, "cost_per_100_loc": 0.002 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 2099, "fp": 1911, "fn": 2039, "tn": 275, "precision": 0.5234, "recall": 0.5072, "f2_score": 51.0, "f3_score": 50.9, "cvss_precision": 0.5535, "cvss_recall": 0.5248, "cvss_f3_score": 52.8 }, "strict_micro": { "tp": 2099, "fp": 1911, "fn": 2039, "tn": 275, "precision": 0.5234, "recall": 0.5072, "f2_score": 51.0, "f3_score": 50.9, "cvss_precision": 0.5535, "cvss_recall": 0.5248, "cvss_f3_score": 52.8 }, "macro": { "f2_score": 52.2 }, "per_severity": { "critical": { "tp": 143, "fp": 0, "fn": 15 }, "high": { "tp": 1430, "fp": 0, "fn": 1418 }, "low": { "tp": 45, "fp": 0, "fn": 121 }, "medium": { "tp": 481, "fp": 5, "fn": 485 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 17.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 140, "cost_per_run": 0.0, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 614, "fp": 70, "fn": 1232, "tn": 269, "precision": 0.8977, "recall": 0.3326, "f2_score": 38.1, "f3_score": 35.5, "cvss_precision": 0.9146, "cvss_recall": 0.366, "cvss_f3_score": 38.9 }, "strict_micro": { "tp": 614, "fp": 70, "fn": 3525, "tn": 277, "precision": 0.8977, "recall": 0.1483, "f2_score": 17.8, "f3_score": 16.2, "cvss_precision": 0.9146, "cvss_recall": 0.1593, "cvss_f3_score": 17.4 }, "macro": { "f2_score": 39.8 }, "per_severity": { "critical": { "tp": 125, "fp": 0, "fn": 23 }, "high": { "tp": 284, "fp": 2, "fn": 448 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 194, "fp": 1, "fn": 687 } }, "repos_scored": 64, "repos_total": 140, "f2_stddev": 11.7, "num_runs": 3, "language_coverage": { "python": [ 64, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 81.0473, "successful_runs": 147, "cost_per_run": 0.5513, "total_loc_scanned": 131215, "cost_per_100_loc": 0.027 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 447, "fp": 49, "fn": 1455, "tn": 277, "precision": 0.9012, "recall": 0.235, "f2_score": 27.6, "f3_score": 25.4, "cvss_precision": 0.9468, "cvss_recall": 0.2695, "cvss_f3_score": 29.0 }, "strict_micro": { "tp": 447, "fp": 49, "fn": 3691, "tn": 277, "precision": 0.9012, "recall": 0.108, "f2_score": 13.1, "f3_score": 11.8, "cvss_precision": 0.9468, "cvss_recall": 0.1209, "cvss_f3_score": 13.2 }, "macro": { "f2_score": 29.2 }, "per_severity": { "critical": { "tp": 98, "fp": 1, "fn": 56 }, "high": { "tp": 219, "fp": 1, "fn": 533 }, "low": { "tp": 6, "fp": 0, "fn": 80 }, "medium": { "tp": 124, "fp": 1, "fn": 786 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 18.7, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 66, "cost_per_run": 0.0, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 620, "fp": 183, "fn": 1116, "tn": 249, "precision": 0.7721, "recall": 0.3571, "f2_score": 40.0, "f3_score": 37.7, "cvss_precision": 0.8206, "cvss_recall": 0.3859, "cvss_f3_score": 40.8 }, "strict_micro": { "tp": 620, "fp": 183, "fn": 3518, "tn": 278, "precision": 0.7721, "recall": 0.1498, "f2_score": 17.9, "f3_score": 16.3, "cvss_precision": 0.8206, "cvss_recall": 0.1569, "cvss_f3_score": 17.1 }, "macro": { "f2_score": 41.0 }, "per_severity": { "critical": { "tp": 104, "fp": 1, "fn": 34 }, "high": { "tp": 268, "fp": 0, "fn": 428 }, "low": { "tp": 9, "fp": 0, "fn": 54 }, "medium": { "tp": 233, "fp": 1, "fn": 606 } }, "repos_scored": 62, "repos_total": 140, "f2_stddev": 21.9, "num_runs": 3, "language_coverage": { "python": [ 62, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 13.8959, "successful_runs": 186, "cost_per_run": 0.0747, "total_loc_scanned": 129077, "cost_per_100_loc": 0.0036 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 854, "fp": 314, "fn": 1033, "tn": 272, "precision": 0.7312, "recall": 0.4526, "f2_score": 49.0, "f3_score": 47.0, "cvss_precision": 0.8011, "cvss_recall": 0.4798, "cvss_f3_score": 50.0 }, "strict_micro": { "tp": 854, "fp": 314, "fn": 3284, "tn": 276, "precision": 0.7312, "recall": 0.2064, "f2_score": 24.1, "f3_score": 22.2, "cvss_precision": 0.8011, "cvss_recall": 0.2133, "cvss_f3_score": 23.0 }, "macro": { "f2_score": 49.6 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 25 }, "high": { "tp": 363, "fp": 3, "fn": 383 }, "low": { "tp": 36, "fp": 0, "fn": 48 }, "medium": { "tp": 335, "fp": 2, "fn": 569 } }, "repos_scored": 65, "repos_total": 140, "f2_stddev": 26.3, "num_runs": 3, "language_coverage": { "python": [ 65, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 32.6591, "successful_runs": 195, "cost_per_run": 0.1675, "total_loc_scanned": 133330, "cost_per_100_loc": 0.0082 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 815, "fp": 454, "fn": 1087, "tn": 277, "precision": 0.6422, "recall": 0.4285, "f2_score": 45.9, "f3_score": 44.3, "cvss_precision": 0.7439, "cvss_recall": 0.4584, "cvss_f3_score": 47.7 }, "strict_micro": { "tp": 815, "fp": 454, "fn": 3323, "tn": 277, "precision": 0.6422, "recall": 0.197, "f2_score": 22.9, "f3_score": 21.2, "cvss_precision": 0.7439, "cvss_recall": 0.2057, "cvss_f3_score": 22.2 }, "macro": { "f2_score": 46.1 }, "per_severity": { "critical": { "tp": 119, "fp": 2, "fn": 35 }, "high": { "tp": 353, "fp": 1, "fn": 399 }, "low": { "tp": 36, "fp": 0, "fn": 50 }, "medium": { "tp": 343, "fp": 1, "fn": 567 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 24.8, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 28.5574, "successful_runs": 197, "cost_per_run": 0.145, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0072 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 2315, "fp": 2842, "fn": 1629, "tn": 272, "precision": 0.4489, "recall": 0.587, "f2_score": 55.3, "f3_score": 56.9, "cvss_precision": 0.4948, "cvss_recall": 0.6073, "cvss_f3_score": 59.4 }, "strict_micro": { "tp": 2315, "fp": 2842, "fn": 1823, "tn": 272, "precision": 0.4489, "recall": 0.5594, "f2_score": 53.3, "f3_score": 54.6, "cvss_precision": 0.4948, "cvss_recall": 0.5786, "cvss_f3_score": 56.9 }, "macro": { "f2_score": 56.2 }, "per_severity": { "critical": { "tp": 146, "fp": 2, "fn": 10 }, "high": { "tp": 1581, "fp": 0, "fn": 1101 }, "low": { "tp": 57, "fp": 0, "fn": 87 }, "medium": { "tp": 531, "fp": 6, "fn": 431 } }, "repos_scored": 136, "repos_total": 140, "f2_stddev": 14.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 70, 74 ] }, "cost": { "total_cost": 105.7309, "successful_runs": 136, "cost_per_run": 0.7774, "total_loc_scanned": 713729, "cost_per_100_loc": 0.0148 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 1053, "fp": 397, "fn": 849, "tn": 280, "precision": 0.7262, "recall": 0.5536, "f2_score": 58.1, "f3_score": 56.7, "cvss_precision": 0.8156, "cvss_recall": 0.5951, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 1053, "fp": 397, "fn": 3085, "tn": 280, "precision": 0.7262, "recall": 0.2545, "f2_score": 29.2, "f3_score": 27.2, "cvss_precision": 0.8156, "cvss_recall": 0.267, "cvss_f3_score": 28.6 }, "macro": { "f2_score": 59.7 }, "per_severity": { "critical": { "tp": 146, "fp": 1, "fn": 8 }, "high": { "tp": 455, "fp": 0, "fn": 297 }, "low": { "tp": 41, "fp": 0, "fn": 45 }, "medium": { "tp": 412, "fp": 1, "fn": 498 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 12.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 144.1409, "successful_runs": 196, "cost_per_run": 0.7354, "total_loc_scanned": 133782, "cost_per_100_loc": 0.036 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 760, "fp": 168, "fn": 1142, "tn": 278, "precision": 0.819, "recall": 0.3996, "f2_score": 44.5, "f3_score": 42.1, "cvss_precision": 0.8825, "cvss_recall": 0.4339, "cvss_f3_score": 45.7 }, "strict_micro": { "tp": 760, "fp": 168, "fn": 3378, "tn": 278, "precision": 0.819, "recall": 0.1837, "f2_score": 21.7, "f3_score": 19.9, "cvss_precision": 0.8825, "cvss_recall": 0.1947, "cvss_f3_score": 21.1 }, "macro": { "f2_score": 46.7 }, "per_severity": { "critical": { "tp": 128, "fp": 0, "fn": 26 }, "high": { "tp": 334, "fp": 0, "fn": 418 }, "low": { "tp": 15, "fp": 0, "fn": 71 }, "medium": { "tp": 283, "fp": 2, "fn": 627 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 1.0844, "successful_runs": 66, "cost_per_run": 0.0164, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0008 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 3183, "fp": 2182, "fn": 955, "tn": 277, "precision": 0.5933, "recall": 0.7692, "f2_score": 72.6, "f3_score": 74.7, "cvss_precision": 0.6133, "cvss_recall": 0.7758, "cvss_f3_score": 75.6 }, "strict_micro": { "tp": 3183, "fp": 2182, "fn": 955, "tn": 277, "precision": 0.5933, "recall": 0.7692, "f2_score": 72.6, "f3_score": 74.7, "cvss_precision": 0.6133, "cvss_recall": 0.7758, "cvss_f3_score": 75.6 }, "macro": { "f2_score": 72.7 }, "per_severity": { "critical": { "tp": 145, "fp": 0, "fn": 13 }, "high": { "tp": 2196, "fp": 1, "fn": 652 }, "low": { "tp": 105, "fp": 0, "fn": 61 }, "medium": { "tp": 737, "fp": 2, "fn": 229 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 21.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 560.3368, "successful_runs": 140, "cost_per_run": 4.0024, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0756 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 886, "fp": 273, "fn": 1016, "tn": 279, "precision": 0.7645, "recall": 0.4658, "f2_score": 50.5, "f3_score": 48.5, "cvss_precision": 0.8262, "cvss_recall": 0.5087, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 886, "fp": 273, "fn": 3252, "tn": 279, "precision": 0.7645, "recall": 0.2141, "f2_score": 25.0, "f3_score": 23.1, "cvss_precision": 0.8262, "cvss_recall": 0.2283, "cvss_f3_score": 24.6 }, "macro": { "f2_score": 53.1 }, "per_severity": { "critical": { "tp": 137, "fp": 0, "fn": 17 }, "high": { "tp": 406, "fp": 0, "fn": 346 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 315, "fp": 1, "fn": 595 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 15.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 29.62, "successful_runs": 66, "cost_per_run": 0.4488, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0221 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 2197, "fp": 2715, "fn": 1941, "tn": 276, "precision": 0.4473, "recall": 0.5309, "f2_score": 51.2, "f3_score": 52.1, "cvss_precision": 0.476, "cvss_recall": 0.5619, "cvss_f3_score": 55.2 }, "strict_micro": { "tp": 2197, "fp": 2715, "fn": 1941, "tn": 276, "precision": 0.4473, "recall": 0.5309, "f2_score": 51.2, "f3_score": 52.1, "cvss_precision": 0.476, "cvss_recall": 0.5619, "cvss_f3_score": 55.2 }, "macro": { "f2_score": 52.0 }, "per_severity": { "critical": { "tp": 135, "fp": 0, "fn": 23 }, "high": { "tp": 1654, "fp": 1, "fn": 1194 }, "low": { "tp": 41, "fp": 0, "fn": 125 }, "medium": { "tp": 367, "fp": 3, "fn": 599 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 13.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 1040.6151, "successful_runs": 140, "cost_per_run": 7.433, "total_loc_scanned": 741034, "cost_per_100_loc": 0.1404 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 3383, "fp": 1905, "fn": 755, "tn": 278, "precision": 0.6398, "recall": 0.8175, "f2_score": 77.4, "f3_score": 79.5, "cvss_precision": 0.6574, "cvss_recall": 0.8196, "cvss_f3_score": 80.0 }, "strict_micro": { "tp": 3383, "fp": 1905, "fn": 755, "tn": 278, "precision": 0.6398, "recall": 0.8175, "f2_score": 77.4, "f3_score": 79.5, "cvss_precision": 0.6574, "cvss_recall": 0.8196, "cvss_f3_score": 80.0 }, "macro": { "f2_score": 77.5 }, "per_severity": { "critical": { "tp": 144, "fp": 0, "fn": 14 }, "high": { "tp": 2350, "fp": 0, "fn": 498 }, "low": { "tp": 113, "fp": 0, "fn": 53 }, "medium": { "tp": 776, "fp": 2, "fn": 190 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 19.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 547.5611, "successful_runs": 140, "cost_per_run": 3.9112, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0739 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 842, "fp": 322, "fn": 1059, "tn": 269, "precision": 0.7234, "recall": 0.4429, "f2_score": 48.0, "f3_score": 46.1, "cvss_precision": 0.7945, "cvss_recall": 0.471, "cvss_f3_score": 49.1 }, "strict_micro": { "tp": 842, "fp": 322, "fn": 3295, "tn": 269, "precision": 0.7234, "recall": 0.2035, "f2_score": 23.8, "f3_score": 21.9, "cvss_precision": 0.7945, "cvss_recall": 0.2113, "cvss_f3_score": 22.8 }, "macro": { "f2_score": 49.1 }, "per_severity": { "critical": { "tp": 136, "fp": 1, "fn": 18 }, "high": { "tp": 336, "fp": 7, "fn": 416 }, "low": { "tp": 31, "fp": 0, "fn": 55 }, "medium": { "tp": 325, "fp": 2, "fn": 585 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.3, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 7.9565, "successful_runs": 192, "cost_per_run": 0.0414, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0021 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 908, "fp": 312, "fn": 995, "tn": 277, "precision": 0.7443, "recall": 0.4771, "f2_score": 51.4, "f3_score": 49.5, "cvss_precision": 0.8333, "cvss_recall": 0.5123, "cvss_f3_score": 53.3 }, "strict_micro": { "tp": 908, "fp": 312, "fn": 3231, "tn": 277, "precision": 0.7443, "recall": 0.2194, "f2_score": 25.5, "f3_score": 23.6, "cvss_precision": 0.8333, "cvss_recall": 0.2299, "cvss_f3_score": 24.8 }, "macro": { "f2_score": 52.5 }, "per_severity": { "critical": { "tp": 129, "fp": 1, "fn": 25 }, "high": { "tp": 365, "fp": 3, "fn": 387 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 338, "fp": 1, "fn": 572 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 14.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 21.0418, "successful_runs": 157, "cost_per_run": 0.134, "total_loc_scanned": 133329, "cost_per_100_loc": 0.0064 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 965, "fp": 464, "fn": 936, "tn": 276, "precision": 0.6753, "recall": 0.5076, "f2_score": 53.4, "f3_score": 52.1, "cvss_precision": 0.7922, "cvss_recall": 0.5467, "cvss_f3_score": 56.4 }, "strict_micro": { "tp": 965, "fp": 464, "fn": 3172, "tn": 276, "precision": 0.6753, "recall": 0.2333, "f2_score": 26.8, "f3_score": 25.0, "cvss_precision": 0.7922, "cvss_recall": 0.2453, "cvss_f3_score": 26.3 }, "macro": { "f2_score": 55.0 }, "per_severity": { "critical": { "tp": 139, "fp": 1, "fn": 15 }, "high": { "tp": 419, "fp": 1, "fn": 333 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 391, "fp": 4, "fn": 519 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.0, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 25.5527, "successful_runs": 187, "cost_per_run": 0.1366, "total_loc_scanned": 133782, "cost_per_100_loc": 0.007 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 1107, "fp": 409, "fn": 795, "tn": 277, "precision": 0.7302, "recall": 0.582, "f2_score": 60.7, "f3_score": 59.4, "cvss_precision": 0.8323, "cvss_recall": 0.6077, "cvss_f3_score": 62.5 }, "strict_micro": { "tp": 1107, "fp": 409, "fn": 3031, "tn": 277, "precision": 0.7302, "recall": 0.2675, "f2_score": 30.6, "f3_score": 28.6, "cvss_precision": 0.8323, "cvss_recall": 0.2727, "cvss_f3_score": 29.2 }, "macro": { "f2_score": 62.3 }, "per_severity": { "critical": { "tp": 142, "fp": 0, "fn": 12 }, "high": { "tp": 468, "fp": 2, "fn": 284 }, "low": { "tp": 46, "fp": 0, "fn": 40 }, "medium": { "tp": 451, "fp": 1, "fn": 459 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 21.3334, "successful_runs": 66, "cost_per_run": 0.3232, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0159 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 883, "fp": 437, "fn": 1019, "tn": 262, "precision": 0.6689, "recall": 0.4642, "f2_score": 49.5, "f3_score": 47.9, "cvss_precision": 0.6852, "cvss_recall": 0.4946, "cvss_f3_score": 50.9 }, "strict_micro": { "tp": 883, "fp": 437, "fn": 3255, "tn": 262, "precision": 0.6689, "recall": 0.2134, "f2_score": 24.7, "f3_score": 22.9, "cvss_precision": 0.6852, "cvss_recall": 0.2219, "cvss_f3_score": 23.8 }, "macro": { "f2_score": 51.4 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 26 }, "high": { "tp": 398, "fp": 3, "fn": 354 }, "low": { "tp": 23, "fp": 0, "fn": 63 }, "medium": { "tp": 334, "fp": 14, "fn": 576 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 16.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 290.6804, "successful_runs": 66, "cost_per_run": 4.4042, "total_loc_scanned": 133782, "cost_per_100_loc": 0.2173 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 1466, "fp": 3126, "fn": 436, "tn": 261, "precision": 0.3193, "recall": 0.7708, "f2_score": 60.1, "f3_score": 67.5, "cvss_precision": 0.3021, "cvss_recall": 0.7825, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 1466, "fp": 3126, "fn": 2672, "tn": 261, "precision": 0.3193, "recall": 0.3543, "f2_score": 34.7, "f3_score": 35.0, "cvss_precision": 0.3021, "cvss_recall": 0.3511, "cvss_f3_score": 34.6 }, "macro": { "f2_score": 60.5 }, "per_severity": { "critical": { "tp": 139, "fp": 2, "fn": 15 }, "high": { "tp": 576, "fp": 8, "fn": 176 }, "low": { "tp": 58, "fp": 1, "fn": 28 }, "medium": { "tp": 693, "fp": 8, "fn": 217 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 9.0, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 146.0, "successful_runs": 66, "cost_per_run": 2.2121, "total_loc_scanned": 133782, "cost_per_100_loc": 0.1091 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 1310, "fp": 1668, "fn": 592, "tn": 267, "precision": 0.4399, "recall": 0.6887, "f2_score": 61.9, "f3_score": 65.2, "cvss_precision": 0.4195, "cvss_recall": 0.7062, "cvss_f3_score": 66.1 }, "strict_micro": { "tp": 1310, "fp": 1668, "fn": 2828, "tn": 267, "precision": 0.4399, "recall": 0.3166, "f2_score": 33.5, "f3_score": 32.6, "cvss_precision": 0.4195, "cvss_recall": 0.3169, "cvss_f3_score": 32.5 }, "macro": { "f2_score": 63.0 }, "per_severity": { "critical": { "tp": 138, "fp": 0, "fn": 16 }, "high": { "tp": 529, "fp": 7, "fn": 223 }, "low": { "tp": 45, "fp": 1, "fn": 41 }, "medium": { "tp": 598, "fp": 5, "fn": 312 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 22.25, "successful_runs": 66, "cost_per_run": 0.3371, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0166 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 235, "fp": 120, "fn": 1667, "tn": 279, "precision": 0.662, "recall": 0.1236, "f2_score": 14.8, "f3_score": 13.4, "cvss_precision": 0.643, "cvss_recall": 0.1444, "cvss_f3_score": 15.6 }, "strict_micro": { "tp": 235, "fp": 120, "fn": 3903, "tn": 279, "precision": 0.662, "recall": 0.0568, "f2_score": 6.9, "f3_score": 6.3, "cvss_precision": 0.643, "cvss_recall": 0.0648, "cvss_f3_score": 7.1 }, "macro": { "f2_score": 16.3 }, "per_severity": { "critical": { "tp": 36, "fp": 0, "fn": 118 }, "high": { "tp": 129, "fp": 1, "fn": 623 }, "low": { "tp": 4, "fp": 0, "fn": 82 }, "medium": { "tp": 66, "fp": 0, "fn": 844 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 1525, "fp": 3180, "fn": 377, "tn": 247, "precision": 0.3241, "recall": 0.8018, "f2_score": 61.9, "f3_score": 69.9, "cvss_precision": 0.2963, "cvss_recall": 0.8146, "cvss_f3_score": 69.3 }, "strict_micro": { "tp": 1525, "fp": 3180, "fn": 2613, "tn": 247, "precision": 0.3241, "recall": 0.3685, "f2_score": 35.9, "f3_score": 36.4, "cvss_precision": 0.2963, "cvss_recall": 0.3655, "cvss_f3_score": 35.7 }, "macro": { "f2_score": 62.9 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 608, "fp": 10, "fn": 144 }, "low": { "tp": 64, "fp": 2, "fn": 22 }, "medium": { "tp": 702, "fp": 16, "fn": 208 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 8.5, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 3733, "fp": 3277, "fn": 405, "tn": 270, "precision": 0.5325, "recall": 0.9021, "f2_score": 79.2, "f3_score": 84.4, "cvss_precision": 0.4866, "cvss_recall": 0.9028, "cvss_f3_score": 83.2 }, "strict_micro": { "tp": 3733, "fp": 3277, "fn": 405, "tn": 270, "precision": 0.5325, "recall": 0.9021, "f2_score": 79.2, "f3_score": 84.4, "cvss_precision": 0.4866, "cvss_recall": 0.9028, "cvss_f3_score": 83.2 }, "macro": { "f2_score": 79.2 }, "per_severity": { "critical": { "tp": 145, "fp": 1, "fn": 13 }, "high": { "tp": 2586, "fp": 4, "fn": 262 }, "low": { "tp": 146, "fp": 0, "fn": 20 }, "medium": { "tp": 856, "fp": 5, "fn": 110 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 10.0, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 986, "fp": 1115, "fn": 916, "tn": 277, "precision": 0.4693, "recall": 0.5184, "f2_score": 50.8, "f3_score": 51.3, "cvss_precision": 0.4737, "cvss_recall": 0.5437, "cvss_f3_score": 53.6 }, "strict_micro": { "tp": 986, "fp": 1115, "fn": 3152, "tn": 277, "precision": 0.4693, "recall": 0.2383, "f2_score": 26.4, "f3_score": 25.1, "cvss_precision": 0.4737, "cvss_recall": 0.244, "cvss_f3_score": 25.6 }, "macro": { "f2_score": 52.0 }, "per_severity": { "critical": { "tp": 119, "fp": 0, "fn": 35 }, "high": { "tp": 407, "fp": 2, "fn": 345 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 427, "fp": 1, "fn": 483 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 15.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 1549, "fp": 4289, "fn": 353, "tn": 247, "precision": 0.2653, "recall": 0.8144, "f2_score": 57.6, "f3_score": 67.5, "cvss_precision": 0.2485, "cvss_recall": 0.8265, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 1549, "fp": 4289, "fn": 2589, "tn": 247, "precision": 0.2653, "recall": 0.3743, "f2_score": 34.6, "f3_score": 36.0, "cvss_precision": 0.2485, "cvss_recall": 0.3708, "cvss_f3_score": 35.3 }, "macro": { "f2_score": 58.8 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 613, "fp": 10, "fn": 139 }, "low": { "tp": 68, "fp": 2, "fn": 18 }, "medium": { "tp": 717, "fp": 16, "fn": 193 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 9.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 532, "fp": 294, "fn": 1227, "tn": 248, "precision": 0.6441, "recall": 0.3024, "f2_score": 33.8, "f3_score": 31.9, "cvss_precision": 0.7156, "cvss_recall": 0.3409, "cvss_f3_score": 36.0 }, "strict_micro": { "tp": 532, "fp": 294, "fn": 3607, "tn": 268, "precision": 0.6441, "recall": 0.1285, "f2_score": 15.3, "f3_score": 14.0, "cvss_precision": 0.7156, "cvss_recall": 0.142, "cvss_f3_score": 15.4 }, "macro": { "f2_score": 35.4 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 44 }, "high": { "tp": 239, "fp": 7, "fn": 453 }, "low": { "tp": 13, "fp": 0, "fn": 69 }, "medium": { "tp": 164, "fp": 10, "fn": 674 } }, "repos_scored": 61, "repos_total": 140, "f2_stddev": 16.2, "num_runs": 3, "language_coverage": { "python": [ 61, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 7.523, "successful_runs": 136, "cost_per_run": 0.0553, "total_loc_scanned": 116141, "cost_per_100_loc": 0.0032 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 417, "fp": 363, "fn": 1241, "tn": 232, "precision": 0.5346, "recall": 0.2515, "f2_score": 28.1, "f3_score": 26.6, "cvss_precision": 0.613, "cvss_recall": 0.2758, "cvss_f3_score": 29.2 }, "strict_micro": { "tp": 417, "fp": 363, "fn": 3721, "tn": 266, "precision": 0.5346, "recall": 0.1008, "f2_score": 12.0, "f3_score": 11.0, "cvss_precision": 0.613, "cvss_recall": 0.1079, "cvss_f3_score": 11.8 }, "macro": { "f2_score": 28.1 }, "per_severity": { "critical": { "tp": 70, "fp": 1, "fn": 69 }, "high": { "tp": 179, "fp": 6, "fn": 479 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 156, "fp": 7, "fn": 637 } }, "repos_scored": 58, "repos_total": 140, "f2_stddev": 24.8, "num_runs": 1, "language_coverage": { "python": [ 58, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 58, "cost_per_run": 0.0, "total_loc_scanned": 117112, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 674, "fp": 437, "fn": 1192, "tn": 260, "precision": 0.6067, "recall": 0.3612, "f2_score": 39.3, "f3_score": 37.6, "cvss_precision": 0.7016, "cvss_recall": 0.3906, "cvss_f3_score": 40.9 }, "strict_micro": { "tp": 674, "fp": 437, "fn": 3464, "tn": 264, "precision": 0.6067, "recall": 0.1629, "f2_score": 19.1, "f3_score": 17.6, "cvss_precision": 0.7016, "cvss_recall": 0.1716, "cvss_f3_score": 18.6 }, "macro": { "f2_score": 42.3 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 48 }, "high": { "tp": 292, "fp": 8, "fn": 446 }, "low": { "tp": 21, "fp": 1, "fn": 64 }, "medium": { "tp": 259, "fp": 6, "fn": 634 } }, "repos_scored": 65, "repos_total": 140, "f2_stddev": 21.4, "num_runs": 1, "language_coverage": { "python": [ 65, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 65, "cost_per_run": 0.0, "total_loc_scanned": 131775, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 445, "fp": 1737, "fn": 1422, "tn": 247, "precision": 0.2039, "recall": 0.2384, "f2_score": 23.1, "f3_score": 23.4, "cvss_precision": 0.3196, "cvss_recall": 0.2624, "cvss_f3_score": 26.7 }, "strict_micro": { "tp": 445, "fp": 1737, "fn": 3693, "tn": 254, "precision": 0.2039, "recall": 0.1075, "f2_score": 11.9, "f3_score": 11.3, "cvss_precision": 0.3196, "cvss_recall": 0.1151, "cvss_f3_score": 12.3 }, "macro": { "f2_score": 23.5 }, "per_severity": { "critical": { "tp": 118, "fp": 2, "fn": 31 }, "high": { "tp": 145, "fp": 20, "fn": 593 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 176, "fp": 4, "fn": 720 } }, "repos_scored": 64, "repos_total": 140, "f2_stddev": 9.1, "num_runs": 1, "language_coverage": { "python": [ 64, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 410, "fp": 3145, "fn": 3728, "tn": 275, "precision": 0.1153, "recall": 0.0991, "f2_score": 10.2, "f3_score": 10.0, "cvss_precision": 0.1393, "cvss_recall": 0.1145, "cvss_f3_score": 11.7 }, "strict_micro": { "tp": 410, "fp": 3145, "fn": 3728, "tn": 275, "precision": 0.1153, "recall": 0.0991, "f2_score": 10.2, "f3_score": 10.0, "cvss_precision": 0.1393, "cvss_recall": 0.1145, "cvss_f3_score": 11.7 }, "macro": { "f2_score": 9.9 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 117 }, "high": { "tp": 318, "fp": 4, "fn": 2530 }, "low": { "tp": 3, "fp": 0, "fn": 163 }, "medium": { "tp": 48, "fp": 1, "fn": 918 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 11.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 274, "fp": 1587, "fn": 1628, "tn": 279, "precision": 0.1472, "recall": 0.1441, "f2_score": 14.5, "f3_score": 14.4, "cvss_precision": 0.1601, "cvss_recall": 0.1439, "cvss_f3_score": 14.5 }, "strict_micro": { "tp": 274, "fp": 1587, "fn": 3864, "tn": 279, "precision": 0.1472, "recall": 0.0662, "f2_score": 7.4, "f3_score": 7.0, "cvss_precision": 0.1601, "cvss_recall": 0.0645, "cvss_f3_score": 6.9 }, "macro": { "f2_score": 13.6 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 113 }, "high": { "tp": 91, "fp": 0, "fn": 661 }, "low": { "tp": 0, "fp": 0, "fn": 86 }, "medium": { "tp": 142, "fp": 1, "fn": 768 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "benchmark_version": "3.1.0", "ground_truth_content_hash": "sha256:0754363572503562e692414f826aad6f135f254851b8d12f70148bd235d23585", "default_prompt_version": "sha256:3481f1432c23", "scanner_metadata": { "claude-opus-5-cc-agentic-v1": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "claude-sonnet-5-cc-agentic-v1": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 }, "deepseek-v4-flash-agentic-v1": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 }, "deepseek-v4-pro-agentic-v1": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 }, "deepseek-v4.1-flash-agentic-v1": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 }, "gemini-3.5-flash-agentic-v1": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 }, "gemma4-31b-agentic-v1": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "glm-5-agentic-v1": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 }, "glm-5.1-agentic-v1": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 }, "glm-5.2-agentic-v1": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 }, "glm-5.3-agentic-v1": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 }, "gpt-5.5-agentic-v1": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 }, "gpt-5.6-luna-codex-cli": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "gpt-5.6-sol-codex-cli": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 }, "gpt-5.6-terra-codex-cli": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "gpt-6-astra-codex-cli": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 }, "gpt-daybreak-blue-codex-cli": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 }, "kimi-k2.5-agentic-v1": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 }, "kimi-k2.6-agentic-v1": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 }, "kimi-k2.7-agentic-v1": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 }, "kimi-k3-agentic-v1": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "kolega-ca-cc-sonnet": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "kolega-claude-adaptation": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "kolega-claude-adaptation-deepseek-only": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 }, "kolega-claude-adaptation-v1": { "has_metrics": false }, "kolega-devsec-core-v0.0.1": { "has_metrics": false }, "kolega-devsec-max-v0.1.0": { "has_metrics": false }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "has_metrics": false }, "kolega-v0.0.2-raw": { "has_metrics": false }, "minimax-m2.7-agentic-v1": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 }, "ornith-q3-agentic-v1": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 }, "qwen3.6-35b-agentic-v1": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 }, "rowan": { "has_metrics": false }, "semgrep": { "has_metrics": false }, "sonarqube": { "has_metrics": false } }, "source_aggregates": { "intentional": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 487, "fp": 331, "fn": 216, "tn": 117, "precision": 0.5954, "recall": 0.6927, "f2_score": 67.1, "f3_score": 68.2, "cvss_precision": 0.6605, "cvss_recall": 0.7246, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 487, "fp": 331, "fn": 751, "tn": 117, "precision": 0.5954, "recall": 0.3934, "f2_score": 42.2, "f3_score": 40.7, "cvss_precision": 0.6605, "cvss_recall": 0.415, "cvss_f3_score": 43.1 }, "macro": { "f2_score": 70.5 }, "per_severity": { "critical": { "tp": 80, "fp": 2, "fn": 7 }, "high": { "tp": 187, "fp": 1, "fn": 78 }, "low": { "tp": 35, "fp": 0, "fn": 33 }, "medium": { "tp": 185, "fp": 1, "fn": 98 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.2, "num_runs": 1 }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 516, "fp": 462, "fn": 722, "tn": 118, "precision": 0.5276, "recall": 0.4168, "f2_score": 43.5, "f3_score": 42.6, "cvss_precision": 0.5892, "cvss_recall": 0.4553, "cvss_f3_score": 46.6 }, "strict_micro": { "tp": 516, "fp": 462, "fn": 722, "tn": 118, "precision": 0.5276, "recall": 0.4168, "f2_score": 43.5, "f3_score": 42.6, "cvss_precision": 0.5892, "cvss_recall": 0.4553, "cvss_f3_score": 46.6 }, "macro": { "f2_score": 46.9 }, "per_severity": { "critical": { "tp": 74, "fp": 1, "fn": 13 }, "high": { "tp": 315, "fp": 1, "fn": 401 }, "low": { "tp": 16, "fp": 0, "fn": 121 }, "medium": { "tp": 111, "fp": 1, "fn": 187 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.8, "num_runs": 1 }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 539, "fp": 406, "fn": 699, "tn": 118, "precision": 0.5704, "recall": 0.4354, "f2_score": 45.7, "f3_score": 44.6, "cvss_precision": 0.6291, "cvss_recall": 0.4668, "cvss_f3_score": 47.9 }, "strict_micro": { "tp": 539, "fp": 406, "fn": 699, "tn": 118, "precision": 0.5704, "recall": 0.4354, "f2_score": 45.7, "f3_score": 44.6, "cvss_precision": 0.6291, "cvss_recall": 0.4668, "cvss_f3_score": 47.9 }, "macro": { "f2_score": 51.0 }, "per_severity": { "critical": { "tp": 79, "fp": 0, "fn": 8 }, "high": { "tp": 296, "fp": 1, "fn": 420 }, "low": { "tp": 31, "fp": 0, "fn": 106 }, "medium": { "tp": 130, "fp": 0, "fn": 168 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 24.6, "num_runs": 3 }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 517, "fp": 325, "fn": 720, "tn": 117, "precision": 0.614, "recall": 0.4179, "f2_score": 44.6, "f3_score": 43.2, "cvss_precision": 0.6695, "cvss_recall": 0.4545, "cvss_f3_score": 47.0 }, "strict_micro": { "tp": 517, "fp": 325, "fn": 720, "tn": 117, "precision": 0.614, "recall": 0.4179, "f2_score": 44.6, "f3_score": 43.2, "cvss_precision": 0.6695, "cvss_recall": 0.4545, "cvss_f3_score": 47.0 }, "macro": { "f2_score": 47.8 }, "per_severity": { "critical": { "tp": 72, "fp": 2, "fn": 15 }, "high": { "tp": 301, "fp": 1, "fn": 415 }, "low": { "tp": 26, "fp": 0, "fn": 111 }, "medium": { "tp": 121, "fp": 1, "fn": 177 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.3, "num_runs": 3 }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 627, "fp": 503, "fn": 611, "tn": 121, "precision": 0.5549, "recall": 0.5065, "f2_score": 51.5, "f3_score": 51.1, "cvss_precision": 0.5993, "cvss_recall": 0.5385, "cvss_f3_score": 54.4 }, "strict_micro": { "tp": 627, "fp": 503, "fn": 611, "tn": 121, "precision": 0.5549, "recall": 0.5065, "f2_score": 51.5, "f3_score": 51.1, "cvss_precision": 0.5993, "cvss_recall": 0.5385, "cvss_f3_score": 54.4 }, "macro": { "f2_score": 54.4 }, "per_severity": { "critical": { "tp": 78, "fp": 0, "fn": 9 }, "high": { "tp": 360, "fp": 0, "fn": 356 }, "low": { "tp": 26, "fp": 0, "fn": 111 }, "medium": { "tp": 163, "fp": 0, "fn": 135 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 22.2, "num_runs": 1 }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 227, "fp": 40, "fn": 449, "tn": 114, "precision": 0.8502, "recall": 0.3358, "f2_score": 38.2, "f3_score": 35.7, "cvss_precision": 0.8822, "cvss_recall": 0.3759, "cvss_f3_score": 39.9 }, "strict_micro": { "tp": 227, "fp": 40, "fn": 1011, "tn": 118, "precision": 0.8502, "recall": 0.1834, "f2_score": 21.7, "f3_score": 19.9, "cvss_precision": 0.8822, "cvss_recall": 0.2075, "cvss_f3_score": 22.5 }, "macro": { "f2_score": 42.6 }, "per_severity": { "critical": { "tp": 62, "fp": 0, "fn": 20 }, "high": { "tp": 100, "fp": 2, "fn": 156 }, "low": { "tp": 4, "fp": 0, "fn": 62 }, "medium": { "tp": 51, "fp": 0, "fn": 221 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 16.3, "num_runs": 3 }, "gemma4-31b-agentic-v1": { "micro": { "tp": 185, "fp": 22, "fn": 518, "tn": 118, "precision": 0.8937, "recall": 0.2632, "f2_score": 30.6, "f3_score": 28.3, "cvss_precision": 0.9286, "cvss_recall": 0.3011, "cvss_f3_score": 32.3 }, "strict_micro": { "tp": 185, "fp": 22, "fn": 1053, "tn": 118, "precision": 0.8937, "recall": 0.1494, "f2_score": 17.9, "f3_score": 16.3, "cvss_precision": 0.9286, "cvss_recall": 0.1725, "cvss_f3_score": 18.8 }, "macro": { "f2_score": 35.3 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 35 }, "high": { "tp": 85, "fp": 1, "fn": 180 }, "low": { "tp": 2, "fp": 0, "fn": 66 }, "medium": { "tp": 46, "fp": 1, "fn": 237 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 19.3, "num_runs": 1 }, "glm-5-agentic-v1": { "micro": { "tp": 254, "fp": 105, "fn": 283, "tn": 90, "precision": 0.7075, "recall": 0.473, "f2_score": 50.7, "f3_score": 48.9, "cvss_precision": 0.7629, "cvss_recall": 0.5203, "cvss_f3_score": 53.7 }, "strict_micro": { "tp": 254, "fp": 105, "fn": 984, "tn": 119, "precision": 0.7075, "recall": 0.2052, "f2_score": 23.9, "f3_score": 22.1, "cvss_precision": 0.7629, "cvss_recall": 0.2286, "cvss_f3_score": 24.6 }, "macro": { "f2_score": 54.4 }, "per_severity": { "critical": { "tp": 60, "fp": 1, "fn": 11 }, "high": { "tp": 116, "fp": 0, "fn": 93 }, "low": { "tp": 5, "fp": 0, "fn": 40 }, "medium": { "tp": 68, "fp": 0, "fn": 144 } }, "repos_scored": 22, "repos_total": 50, "f2_stddev": 11.4, "num_runs": 3 }, "glm-5.1-agentic-v1": { "micro": { "tp": 393, "fp": 135, "fn": 295, "tn": 113, "precision": 0.7443, "recall": 0.5712, "f2_score": 59.9, "f3_score": 58.5, "cvss_precision": 0.7997, "cvss_recall": 0.6053, "cvss_f3_score": 62.0 }, "strict_micro": { "tp": 393, "fp": 135, "fn": 845, "tn": 117, "precision": 0.7443, "recall": 0.3174, "f2_score": 35.9, "f3_score": 33.7, "cvss_precision": 0.7997, "cvss_recall": 0.3388, "cvss_f3_score": 36.0 }, "macro": { "f2_score": 64.2 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 7 }, "high": { "tp": 163, "fp": 3, "fn": 96 }, "low": { "tp": 22, "fp": 0, "fn": 44 }, "medium": { "tp": 128, "fp": 2, "fn": 149 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 18.6, "num_runs": 3 }, "glm-5.2-agentic-v1": { "micro": { "tp": 367, "fp": 184, "fn": 336, "tn": 118, "precision": 0.6661, "recall": 0.522, "f2_score": 54.6, "f3_score": 53.4, "cvss_precision": 0.7379, "cvss_recall": 0.5637, "cvss_f3_score": 57.7 }, "strict_micro": { "tp": 367, "fp": 184, "fn": 871, "tn": 118, "precision": 0.6661, "recall": 0.2964, "f2_score": 33.3, "f3_score": 31.4, "cvss_precision": 0.7379, "cvss_recall": 0.3229, "cvss_f3_score": 34.2 }, "macro": { "f2_score": 58.3 }, "per_severity": { "critical": { "tp": 76, "fp": 2, "fn": 11 }, "high": { "tp": 166, "fp": 1, "fn": 99 }, "low": { "tp": 24, "fp": 0, "fn": 44 }, "medium": { "tp": 148, "fp": 1, "fn": 135 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 15.4, "num_runs": 3 }, "glm-5.3-agentic-v1": { "micro": { "tp": 684, "fp": 766, "fn": 477, "tn": 118, "precision": 0.4717, "recall": 0.5891, "f2_score": 56.1, "f3_score": 57.5, "cvss_precision": 0.529, "cvss_recall": 0.6204, "cvss_f3_score": 61.0 }, "strict_micro": { "tp": 684, "fp": 766, "fn": 554, "tn": 118, "precision": 0.4717, "recall": 0.5525, "f2_score": 53.4, "f3_score": 54.3, "cvss_precision": 0.529, "cvss_recall": 0.584, "cvss_f3_score": 57.8 }, "macro": { "f2_score": 58.1 }, "per_severity": { "critical": { "tp": 81, "fp": 2, "fn": 6 }, "high": { "tp": 389, "fp": 0, "fn": 274 }, "low": { "tp": 37, "fp": 0, "fn": 78 }, "medium": { "tp": 177, "fp": 1, "fn": 119 } }, "repos_scored": 49, "repos_total": 50, "f2_stddev": 19.8, "num_runs": 1 }, "gpt-5.5-agentic-v1": { "micro": { "tp": 410, "fp": 77, "fn": 293, "tn": 121, "precision": 0.8419, "recall": 0.5832, "f2_score": 62.1, "f3_score": 60.2, "cvss_precision": 0.8856, "cvss_recall": 0.6282, "cvss_f3_score": 64.7 }, "strict_micro": { "tp": 410, "fp": 77, "fn": 828, "tn": 121, "precision": 0.8419, "recall": 0.3312, "f2_score": 37.7, "f3_score": 35.3, "cvss_precision": 0.8856, "cvss_recall": 0.3598, "cvss_f3_score": 38.3 }, "macro": { "f2_score": 65.6 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 8 }, "high": { "tp": 162, "fp": 0, "fn": 103 }, "low": { "tp": 23, "fp": 0, "fn": 45 }, "medium": { "tp": 153, "fp": 0, "fn": 130 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 15.8, "num_runs": 3 }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 255, "fp": 38, "fn": 448, "tn": 121, "precision": 0.8703, "recall": 0.3627, "f2_score": 41.1, "f3_score": 38.5, "cvss_precision": 0.9137, "cvss_recall": 0.4107, "cvss_f3_score": 43.5 }, "strict_micro": { "tp": 255, "fp": 38, "fn": 983, "tn": 121, "precision": 0.8703, "recall": 0.206, "f2_score": 24.3, "f3_score": 22.3, "cvss_precision": 0.9137, "cvss_recall": 0.2352, "cvss_f3_score": 25.4 }, "macro": { "f2_score": 46.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 22 }, "high": { "tp": 113, "fp": 0, "fn": 152 }, "low": { "tp": 3, "fp": 0, "fn": 65 }, "medium": { "tp": 74, "fp": 0, "fn": 209 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.9, "num_runs": 1 }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 863, "fp": 551, "fn": 375, "tn": 120, "precision": 0.6103, "recall": 0.6971, "f2_score": 67.8, "f3_score": 68.7, "cvss_precision": 0.6435, "cvss_recall": 0.7106, "cvss_f3_score": 70.3 }, "strict_micro": { "tp": 863, "fp": 551, "fn": 375, "tn": 120, "precision": 0.6103, "recall": 0.6971, "f2_score": 67.8, "f3_score": 68.7, "cvss_precision": 0.6435, "cvss_recall": 0.7106, "cvss_f3_score": 70.3 }, "macro": { "f2_score": 70.0 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 519, "fp": 0, "fn": 197 }, "low": { "tp": 80, "fp": 0, "fn": 57 }, "medium": { "tp": 187, "fp": 1, "fn": 111 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 21.2, "num_runs": 1 }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 325, "fp": 61, "fn": 378, "tn": 121, "precision": 0.842, "recall": 0.4623, "f2_score": 50.8, "f3_score": 48.4, "cvss_precision": 0.8834, "cvss_recall": 0.5063, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 325, "fp": 61, "fn": 913, "tn": 121, "precision": 0.842, "recall": 0.2625, "f2_score": 30.4, "f3_score": 28.2, "cvss_precision": 0.8834, "cvss_recall": 0.29, "cvss_f3_score": 31.1 }, "macro": { "f2_score": 57.2 }, "per_severity": { "critical": { "tp": 72, "fp": 0, "fn": 15 }, "high": { "tp": 129, "fp": 0, "fn": 136 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 112, "fp": 0, "fn": 171 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 20.2, "num_runs": 1 }, "gpt-6-astra-codex-cli": { "micro": { "tp": 626, "fp": 662, "fn": 612, "tn": 120, "precision": 0.486, "recall": 0.5057, "f2_score": 50.2, "f3_score": 50.4, "cvss_precision": 0.527, "cvss_recall": 0.5396, "cvss_f3_score": 53.8 }, "strict_micro": { "tp": 626, "fp": 662, "fn": 612, "tn": 120, "precision": 0.486, "recall": 0.5057, "f2_score": 50.2, "f3_score": 50.4, "cvss_precision": 0.527, "cvss_recall": 0.5396, "cvss_f3_score": 53.8 }, "macro": { "f2_score": 54.6 }, "per_severity": { "critical": { "tp": 74, "fp": 0, "fn": 13 }, "high": { "tp": 381, "fp": 0, "fn": 335 }, "low": { "tp": 23, "fp": 0, "fn": 114 }, "medium": { "tp": 148, "fp": 1, "fn": 150 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 19.4, "num_runs": 1 }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 909, "fp": 493, "fn": 329, "tn": 120, "precision": 0.6484, "recall": 0.7342, "f2_score": 71.5, "f3_score": 72.5, "cvss_precision": 0.6803, "cvss_recall": 0.745, "cvss_f3_score": 73.8 }, "strict_micro": { "tp": 909, "fp": 493, "fn": 329, "tn": 120, "precision": 0.6484, "recall": 0.7342, "f2_score": 71.5, "f3_score": 72.5, "cvss_precision": 0.6803, "cvss_recall": 0.745, "cvss_f3_score": 73.8 }, "macro": { "f2_score": 73.5 }, "per_severity": { "critical": { "tp": 76, "fp": 0, "fn": 11 }, "high": { "tp": 557, "fp": 0, "fn": 159 }, "low": { "tp": 88, "fp": 0, "fn": 49 }, "medium": { "tp": 188, "fp": 1, "fn": 110 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.4, "num_runs": 1 }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 343, "fp": 157, "fn": 360, "tn": 112, "precision": 0.686, "recall": 0.4879, "f2_score": 51.8, "f3_score": 50.2, "cvss_precision": 0.7557, "cvss_recall": 0.5263, "cvss_f3_score": 54.3 }, "strict_micro": { "tp": 343, "fp": 157, "fn": 895, "tn": 112, "precision": 0.686, "recall": 0.2771, "f2_score": 31.5, "f3_score": 29.5, "cvss_precision": 0.7557, "cvss_recall": 0.3014, "cvss_f3_score": 32.1 }, "macro": { "f2_score": 54.0 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 130, "fp": 6, "fn": 135 }, "low": { "tp": 17, "fp": 0, "fn": 51 }, "medium": { "tp": 108, "fp": 0, "fn": 175 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 13.2, "num_runs": 3 }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 389, "fp": 102, "fn": 314, "tn": 118, "precision": 0.7923, "recall": 0.5533, "f2_score": 58.9, "f3_score": 57.1, "cvss_precision": 0.847, "cvss_recall": 0.5936, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 389, "fp": 102, "fn": 849, "tn": 118, "precision": 0.7923, "recall": 0.3142, "f2_score": 35.7, "f3_score": 33.4, "cvss_precision": 0.847, "cvss_recall": 0.34, "cvss_f3_score": 36.2 }, "macro": { "f2_score": 61.2 }, "per_severity": { "critical": { "tp": 68, "fp": 1, "fn": 19 }, "high": { "tp": 143, "fp": 3, "fn": 122 }, "low": { "tp": 11, "fp": 0, "fn": 57 }, "medium": { "tp": 129, "fp": 1, "fn": 154 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.7, "num_runs": 3 }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 385, "fp": 174, "fn": 318, "tn": 118, "precision": 0.6887, "recall": 0.5477, "f2_score": 57.1, "f3_score": 55.9, "cvss_precision": 0.7721, "cvss_recall": 0.5935, "cvss_f3_score": 60.8 }, "strict_micro": { "tp": 385, "fp": 174, "fn": 853, "tn": 118, "precision": 0.6887, "recall": 0.311, "f2_score": 34.9, "f3_score": 32.9, "cvss_precision": 0.7721, "cvss_recall": 0.3399, "cvss_f3_score": 36.0 }, "macro": { "f2_score": 60.8 }, "per_severity": { "critical": { "tp": 73, "fp": 1, "fn": 14 }, "high": { "tp": 171, "fp": 1, "fn": 94 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 143, "fp": 1, "fn": 140 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 11.9, "num_runs": 3 }, "kimi-k3-agentic-v1": { "micro": { "tp": 398, "fp": 93, "fn": 305, "tn": 119, "precision": 0.8106, "recall": 0.5661, "f2_score": 60.2, "f3_score": 58.4, "cvss_precision": 0.8681, "cvss_recall": 0.6039, "cvss_f3_score": 62.3 }, "strict_micro": { "tp": 398, "fp": 93, "fn": 840, "tn": 119, "precision": 0.8106, "recall": 0.3215, "f2_score": 36.6, "f3_score": 34.2, "cvss_precision": 0.8681, "cvss_recall": 0.3459, "cvss_f3_score": 36.8 }, "macro": { "f2_score": 64.0 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 158, "fp": 2, "fn": 107 }, "low": { "tp": 28, "fp": 0, "fn": 40 }, "medium": { "tp": 135, "fp": 0, "fn": 148 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 20.7, "num_runs": 1 }, "kolega-ca-cc-sonnet": { "micro": { "tp": 309, "fp": 127, "fn": 394, "tn": 117, "precision": 0.7087, "recall": 0.4395, "f2_score": 47.6, "f3_score": 45.7, "cvss_precision": 0.716, "cvss_recall": 0.4831, "cvss_f3_score": 49.9 }, "strict_micro": { "tp": 309, "fp": 127, "fn": 929, "tn": 117, "precision": 0.7087, "recall": 0.2496, "f2_score": 28.7, "f3_score": 26.7, "cvss_precision": 0.716, "cvss_recall": 0.2767, "cvss_f3_score": 29.5 }, "macro": { "f2_score": 53.3 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 133, "fp": 2, "fn": 132 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 90, "fp": 1, "fn": 193 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.1, "num_runs": 1 }, "kolega-claude-adaptation": { "micro": { "tp": 521, "fp": 996, "fn": 182, "tn": 117, "precision": 0.3434, "recall": 0.7411, "f2_score": 60.2, "f3_score": 66.4, "cvss_precision": 0.3392, "cvss_recall": 0.7588, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 521, "fp": 996, "fn": 717, "tn": 117, "precision": 0.3434, "recall": 0.4208, "f2_score": 40.3, "f3_score": 41.2, "cvss_precision": 0.3392, "cvss_recall": 0.4346, "cvss_f3_score": 42.3 }, "macro": { "f2_score": 61.6 }, "per_severity": { "critical": { "tp": 75, "fp": 2, "fn": 12 }, "high": { "tp": 197, "fp": 1, "fn": 68 }, "low": { "tp": 40, "fp": 0, "fn": 28 }, "medium": { "tp": 209, "fp": 1, "fn": 74 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 10.9, "num_runs": 1 }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 445, "fp": 524, "fn": 258, "tn": 119, "precision": 0.4592, "recall": 0.633, "f2_score": 58.8, "f3_score": 61.0, "cvss_precision": 0.4615, "cvss_recall": 0.6545, "cvss_f3_score": 62.8 }, "strict_micro": { "tp": 445, "fp": 524, "fn": 793, "tn": 119, "precision": 0.4592, "recall": 0.3595, "f2_score": 37.6, "f3_score": 36.7, "cvss_precision": 0.4615, "cvss_recall": 0.3749, "cvss_f3_score": 38.2 }, "macro": { "f2_score": 62.5 }, "per_severity": { "critical": { "tp": 71, "fp": 0, "fn": 16 }, "high": { "tp": 172, "fp": 2, "fn": 93 }, "low": { "tp": 31, "fp": 0, "fn": 37 }, "medium": { "tp": 171, "fp": 0, "fn": 112 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.4, "num_runs": 1 }, "kolega-claude-adaptation-v1": { "micro": { "tp": 125, "fp": 62, "fn": 578, "tn": 121, "precision": 0.6684, "recall": 0.1778, "f2_score": 20.8, "f3_score": 19.2, "cvss_precision": 0.6483, "cvss_recall": 0.2027, "cvss_f3_score": 21.8 }, "strict_micro": { "tp": 125, "fp": 62, "fn": 1113, "tn": 121, "precision": 0.6684, "recall": 0.101, "f2_score": 12.2, "f3_score": 11.0, "cvss_precision": 0.6483, "cvss_recall": 0.1161, "cvss_f3_score": 12.6 }, "macro": { "f2_score": 24.7 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 52 }, "high": { "tp": 53, "fp": 0, "fn": 212 }, "low": { "tp": 1, "fp": 0, "fn": 67 }, "medium": { "tp": 36, "fp": 0, "fn": 247 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 16.1, "num_runs": 1 }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 586, "fp": 1145, "fn": 117, "tn": 103, "precision": 0.3385, "recall": 0.8336, "f2_score": 64.5, "f3_score": 72.7, "cvss_precision": 0.3176, "cvss_recall": 0.8478, "cvss_f3_score": 72.7 }, "strict_micro": { "tp": 586, "fp": 1145, "fn": 652, "tn": 103, "precision": 0.3385, "recall": 0.4733, "f2_score": 43.8, "f3_score": 45.5, "cvss_precision": 0.3176, "cvss_recall": 0.4856, "cvss_f3_score": 46.1 }, "macro": { "f2_score": 66.4 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 227, "fp": 6, "fn": 38 }, "low": { "tp": 46, "fp": 1, "fn": 22 }, "medium": { "tp": 229, "fp": 6, "fn": 54 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 10.1, "num_runs": 1 }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 1089, "fp": 840, "fn": 149, "tn": 119, "precision": 0.5645, "recall": 0.8796, "f2_score": 79.1, "f3_score": 83.3, "cvss_precision": 0.5293, "cvss_recall": 0.8769, "cvss_f3_score": 82.3 }, "strict_micro": { "tp": 1089, "fp": 840, "fn": 149, "tn": 119, "precision": 0.5645, "recall": 0.8796, "f2_score": 79.1, "f3_score": 83.3, "cvss_precision": 0.5293, "cvss_recall": 0.8769, "cvss_f3_score": 82.3 }, "macro": { "f2_score": 78.9 }, "per_severity": { "critical": { "tp": 76, "fp": 1, "fn": 11 }, "high": { "tp": 630, "fp": 1, "fn": 86 }, "low": { "tp": 127, "fp": 0, "fn": 10 }, "medium": { "tp": 256, "fp": 0, "fn": 42 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 12.9, "num_runs": 1 }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 361, "fp": 296, "fn": 342, "tn": 120, "precision": 0.5495, "recall": 0.5135, "f2_score": 52.0, "f3_score": 51.7, "cvss_precision": 0.5427, "cvss_recall": 0.5414, "cvss_f3_score": 54.2 }, "strict_micro": { "tp": 361, "fp": 296, "fn": 877, "tn": 120, "precision": 0.5495, "recall": 0.2916, "f2_score": 32.2, "f3_score": 30.6, "cvss_precision": 0.5427, "cvss_recall": 0.3101, "cvss_f3_score": 32.4 }, "macro": { "f2_score": 56.1 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 21 }, "high": { "tp": 150, "fp": 1, "fn": 115 }, "low": { "tp": 21, "fp": 0, "fn": 47 }, "medium": { "tp": 124, "fp": 0, "fn": 159 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 17.7, "num_runs": 1 }, "kolega-v0.0.2-raw": { "micro": { "tp": 595, "fp": 1344, "fn": 108, "tn": 103, "precision": 0.3069, "recall": 0.8464, "f2_score": 62.6, "f3_score": 72.0, "cvss_precision": 0.292, "cvss_recall": 0.8574, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 595, "fp": 1344, "fn": 643, "tn": 103, "precision": 0.3069, "recall": 0.4806, "f2_score": 43.2, "f3_score": 45.5, "cvss_precision": 0.292, "cvss_recall": 0.4911, "cvss_f3_score": 46.0 }, "macro": { "f2_score": 64.1 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 228, "fp": 6, "fn": 37 }, "low": { "tp": 50, "fp": 1, "fn": 18 }, "medium": { "tp": 233, "fp": 6, "fn": 50 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 9.2, "num_runs": 1 }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 276, "fp": 110, "fn": 427, "tn": 116, "precision": 0.715, "recall": 0.3926, "f2_score": 43.2, "f3_score": 41.1, "cvss_precision": 0.7684, "cvss_recall": 0.4311, "cvss_f3_score": 45.1 }, "strict_micro": { "tp": 276, "fp": 110, "fn": 962, "tn": 116, "precision": 0.715, "recall": 0.2229, "f2_score": 25.9, "f3_score": 23.9, "cvss_precision": 0.7684, "cvss_recall": 0.2469, "cvss_f3_score": 26.5 }, "macro": { "f2_score": 45.6 }, "per_severity": { "critical": { "tp": 67, "fp": 1, "fn": 20 }, "high": { "tp": 119, "fp": 4, "fn": 146 }, "low": { "tp": 10, "fp": 0, "fn": 58 }, "medium": { "tp": 89, "fp": 2, "fn": 194 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 13.0, "num_runs": 3 }, "ornith-q3-agentic-v1": { "micro": { "tp": 193, "fp": 155, "fn": 381, "tn": 96, "precision": 0.5546, "recall": 0.3362, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6294, "cvss_recall": 0.3629, "cvss_f3_score": 37.9 }, "strict_micro": { "tp": 193, "fp": 155, "fn": 1045, "tn": 114, "precision": 0.5546, "recall": 0.1559, "f2_score": 18.2, "f3_score": 16.8, "cvss_precision": 0.6294, "cvss_recall": 0.172, "cvss_f3_score": 18.5 }, "macro": { "f2_score": 38.6 }, "per_severity": { "critical": { "tp": 46, "fp": 1, "fn": 33 }, "high": { "tp": 78, "fp": 3, "fn": 145 }, "low": { "tp": 9, "fp": 0, "fn": 41 }, "medium": { "tp": 60, "fp": 3, "fn": 162 } }, "repos_scored": 22, "repos_total": 50, "f2_stddev": 26.4, "num_runs": 1 }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 272, "fp": 132, "fn": 395, "tn": 108, "precision": 0.6733, "recall": 0.4078, "f2_score": 44.3, "f3_score": 42.5, "cvss_precision": 0.7478, "cvss_recall": 0.4426, "cvss_f3_score": 46.1 }, "strict_micro": { "tp": 272, "fp": 132, "fn": 966, "tn": 112, "precision": 0.6733, "recall": 0.2197, "f2_score": 25.4, "f3_score": 23.6, "cvss_precision": 0.7478, "cvss_recall": 0.2403, "cvss_f3_score": 25.8 }, "macro": { "f2_score": 52.1 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 31 }, "high": { "tp": 120, "fp": 7, "fn": 131 }, "low": { "tp": 15, "fp": 1, "fn": 52 }, "medium": { "tp": 85, "fp": 0, "fn": 181 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 21.1, "num_runs": 1 }, "rowan": { "micro": { "tp": 148, "fp": 465, "fn": 520, "tn": 103, "precision": 0.2414, "recall": 0.2216, "f2_score": 22.5, "f3_score": 22.3, "cvss_precision": 0.4253, "cvss_recall": 0.2486, "cvss_f3_score": 25.9 }, "strict_micro": { "tp": 148, "fp": 465, "fn": 1090, "tn": 110, "precision": 0.2414, "recall": 0.1195, "f2_score": 13.3, "f3_score": 12.6, "cvss_precision": 0.4253, "cvss_recall": 0.1345, "cvss_f3_score": 14.4 }, "macro": { "f2_score": 23.3 }, "per_severity": { "critical": { "tp": 51, "fp": 2, "fn": 31 }, "high": { "tp": 44, "fp": 7, "fn": 207 }, "low": { "tp": 6, "fp": 0, "fn": 60 }, "medium": { "tp": 47, "fp": 2, "fn": 222 } }, "repos_scored": 24, "repos_total": 50, "f2_stddev": 11.7, "num_runs": 1 }, "semgrep": { "micro": { "tp": 220, "fp": 1444, "fn": 1018, "tn": 116, "precision": 0.1322, "recall": 0.1777, "f2_score": 16.6, "f3_score": 17.2, "cvss_precision": 0.1563, "cvss_recall": 0.1969, "cvss_f3_score": 19.2 }, "strict_micro": { "tp": 220, "fp": 1444, "fn": 1018, "tn": 116, "precision": 0.1322, "recall": 0.1777, "f2_score": 16.6, "f3_score": 17.2, "cvss_precision": 0.1563, "cvss_recall": 0.1969, "cvss_f3_score": 19.2 }, "macro": { "f2_score": 16.8 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 46 }, "high": { "tp": 129, "fp": 4, "fn": 587 }, "low": { "tp": 3, "fp": 0, "fn": 134 }, "medium": { "tp": 47, "fp": 1, "fn": 251 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 15.0, "num_runs": 1 }, "sonarqube": { "micro": { "tp": 44, "fp": 28, "fn": 659, "tn": 120, "precision": 0.6111, "recall": 0.0626, "f2_score": 7.6, "f3_score": 6.9, "cvss_precision": 0.5584, "cvss_recall": 0.0705, "cvss_f3_score": 7.7 }, "strict_micro": { "tp": 44, "fp": 28, "fn": 1194, "tn": 120, "precision": 0.6111, "recall": 0.0355, "f2_score": 4.4, "f3_score": 3.9, "cvss_precision": 0.5584, "cvss_recall": 0.0404, "cvss_f3_score": 4.4 }, "macro": { "f2_score": 6.4 }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 77 }, "high": { "tp": 14, "fp": 0, "fn": 251 }, "low": { "tp": 0, "fp": 0, "fn": 68 }, "medium": { "tp": 20, "fp": 1, "fn": 263 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 11.6, "num_runs": 1 } }, "vibe": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 814, "fp": 468, "fn": 385, "tn": 157, "precision": 0.6349, "recall": 0.6789, "f2_score": 67.0, "f3_score": 67.4, "cvss_precision": 0.6821, "cvss_recall": 0.6912, "cvss_f3_score": 69.0 }, "strict_micro": { "tp": 814, "fp": 468, "fn": 2086, "tn": 157, "precision": 0.6349, "recall": 0.2807, "f2_score": 31.6, "f3_score": 29.7, "cvss_precision": 0.6821, "cvss_recall": 0.2705, "cvss_f3_score": 28.8 }, "macro": { "f2_score": 67.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 337, "fp": 1, "fn": 150 }, "medium": { "tp": 394, "fp": 1, "fn": 233 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 9.9, "num_runs": 1 }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 1242, "fp": 1119, "fn": 1658, "tn": 157, "precision": 0.526, "recall": 0.4283, "f2_score": 44.5, "f3_score": 43.6, "cvss_precision": 0.5683, "cvss_recall": 0.4455, "cvss_f3_score": 45.5 }, "strict_micro": { "tp": 1242, "fp": 1119, "fn": 1658, "tn": 157, "precision": 0.526, "recall": 0.4283, "f2_score": 44.5, "f3_score": 43.6, "cvss_precision": 0.5683, "cvss_recall": 0.4455, "cvss_f3_score": 45.5 }, "macro": { "f2_score": 44.6 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 5 }, "high": { "tp": 866, "fp": 0, "fn": 1266 }, "medium": { "tp": 292, "fp": 2, "fn": 376 }, "low": { "tp": 18, "fp": 0, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 15.1, "num_runs": 1 }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 1144, "fp": 900, "fn": 1756, "tn": 154, "precision": 0.5597, "recall": 0.3945, "f2_score": 41.9, "f3_score": 40.6, "cvss_precision": 0.605, "cvss_recall": 0.4153, "cvss_f3_score": 42.9 }, "strict_micro": { "tp": 1144, "fp": 900, "fn": 1756, "tn": 154, "precision": 0.5597, "recall": 0.3945, "f2_score": 41.9, "f3_score": 40.6, "cvss_precision": 0.605, "cvss_recall": 0.4153, "cvss_f3_score": 42.9 }, "macro": { "f2_score": 42.4 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 809, "fp": 0, "fn": 1323 }, "medium": { "tp": 249, "fp": 3, "fn": 419 }, "low": { "tp": 18, "fp": 2, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 12.1, "num_runs": 1 }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 990, "fp": 642, "fn": 1910, "tn": 158, "precision": 0.6066, "recall": 0.3414, "f2_score": 37.4, "f3_score": 35.7, "cvss_precision": 0.6681, "cvss_recall": 0.3565, "cvss_f3_score": 37.4 }, "strict_micro": { "tp": 990, "fp": 642, "fn": 1910, "tn": 158, "precision": 0.6066, "recall": 0.3414, "f2_score": 37.4, "f3_score": 35.7, "cvss_precision": 0.6681, "cvss_recall": 0.3565, "cvss_f3_score": 37.4 }, "macro": { "f2_score": 36.9 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 667, "fp": 0, "fn": 1465 }, "medium": { "tp": 238, "fp": 1, "fn": 430 }, "low": { "tp": 17, "fp": 0, "fn": 12 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 19.8, "num_runs": 1 }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 1472, "fp": 1408, "fn": 1428, "tn": 154, "precision": 0.5111, "recall": 0.5076, "f2_score": 50.8, "f3_score": 50.8, "cvss_precision": 0.534, "cvss_recall": 0.5185, "cvss_f3_score": 52.0 }, "strict_micro": { "tp": 1472, "fp": 1408, "fn": 1428, "tn": 154, "precision": 0.5111, "recall": 0.5076, "f2_score": 50.8, "f3_score": 50.8, "cvss_precision": 0.534, "cvss_recall": 0.5185, "cvss_f3_score": 52.0 }, "macro": { "f2_score": 51.0 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 6 }, "high": { "tp": 1070, "fp": 0, "fn": 1062 }, "medium": { "tp": 318, "fp": 5, "fn": 350 }, "low": { "tp": 19, "fp": 0, "fn": 10 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 13.7, "num_runs": 1 }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 387, "fp": 30, "fn": 783, "tn": 155, "precision": 0.9281, "recall": 0.3308, "f2_score": 38.0, "f3_score": 35.4, "cvss_precision": 0.9387, "cvss_recall": 0.3594, "cvss_f3_score": 38.3 }, "strict_micro": { "tp": 387, "fp": 30, "fn": 2514, "tn": 159, "precision": 0.9281, "recall": 0.1334, "f2_score": 16.1, "f3_score": 14.6, "cvss_precision": 0.9387, "cvss_recall": 0.137, "cvss_f3_score": 15.0 }, "macro": { "f2_score": 38.1 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 3 }, "high": { "tp": 184, "fp": 0, "fn": 292 }, "medium": { "tp": 143, "fp": 1, "fn": 466 }, "low": { "tp": 2, "fp": 0, "fn": 16 } }, "repos_scored": 39, "repos_total": 90, "f2_stddev": 7.1, "num_runs": 3 }, "gemma4-31b-agentic-v1": { "micro": { "tp": 262, "fp": 27, "fn": 937, "tn": 159, "precision": 0.9066, "recall": 0.2185, "f2_score": 25.8, "f3_score": 23.6, "cvss_precision": 0.9624, "cvss_recall": 0.2481, "cvss_f3_score": 26.8 }, "strict_micro": { "tp": 262, "fp": 27, "fn": 2638, "tn": 159, "precision": 0.9066, "recall": 0.0903, "f2_score": 11.0, "f3_score": 9.9, "cvss_precision": 0.9624, "cvss_recall": 0.0971, "cvss_f3_score": 10.7 }, "macro": { "f2_score": 25.1 }, "per_severity": { "critical": { "tp": 46, "fp": 0, "fn": 21 }, "high": { "tp": 134, "fp": 0, "fn": 353 }, "medium": { "tp": 78, "fp": 0, "fn": 549 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 17.4, "num_runs": 1 }, "glm-5-agentic-v1": { "micro": { "tp": 366, "fp": 78, "fn": 833, "tn": 159, "precision": 0.8243, "recall": 0.3053, "f2_score": 34.9, "f3_score": 32.6, "cvss_precision": 0.8773, "cvss_recall": 0.3162, "cvss_f3_score": 33.8 }, "strict_micro": { "tp": 366, "fp": 78, "fn": 2534, "tn": 159, "precision": 0.8243, "recall": 0.1262, "f2_score": 15.2, "f3_score": 13.8, "cvss_precision": 0.8773, "cvss_recall": 0.1237, "cvss_f3_score": 13.5 }, "macro": { "f2_score": 33.7 }, "per_severity": { "critical": { "tp": 44, "fp": 0, "fn": 23 }, "high": { "tp": 152, "fp": 0, "fn": 335 }, "medium": { "tp": 165, "fp": 1, "fn": 462 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 22.9, "num_runs": 3 }, "glm-5.1-agentic-v1": { "micro": { "tp": 461, "fp": 179, "fn": 738, "tn": 159, "precision": 0.7203, "recall": 0.3845, "f2_score": 42.4, "f3_score": 40.3, "cvss_precision": 0.8025, "cvss_recall": 0.3968, "cvss_f3_score": 41.8 }, "strict_micro": { "tp": 461, "fp": 179, "fn": 2439, "tn": 159, "precision": 0.7203, "recall": 0.159, "f2_score": 18.8, "f3_score": 17.2, "cvss_precision": 0.8025, "cvss_recall": 0.1553, "cvss_f3_score": 16.9 }, "macro": { "f2_score": 40.5 }, "per_severity": { "critical": { "tp": 49, "fp": 0, "fn": 18 }, "high": { "tp": 200, "fp": 0, "fn": 287 }, "medium": { "tp": 207, "fp": 0, "fn": 420 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 26.4, "num_runs": 3 }, "glm-5.2-agentic-v1": { "micro": { "tp": 448, "fp": 270, "fn": 751, "tn": 159, "precision": 0.624, "recall": 0.3736, "f2_score": 40.6, "f3_score": 38.9, "cvss_precision": 0.7499, "cvss_recall": 0.3871, "cvss_f3_score": 40.7 }, "strict_micro": { "tp": 448, "fp": 270, "fn": 2452, "tn": 159, "precision": 0.624, "recall": 0.1545, "f2_score": 18.2, "f3_score": 16.7, "cvss_precision": 0.7499, "cvss_recall": 0.1515, "cvss_f3_score": 16.5 }, "macro": { "f2_score": 38.2 }, "per_severity": { "critical": { "tp": 43, "fp": 0, "fn": 24 }, "high": { "tp": 187, "fp": 0, "fn": 300 }, "medium": { "tp": 195, "fp": 0, "fn": 432 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 26.6, "num_runs": 3 }, "glm-5.3-agentic-v1": { "micro": { "tp": 1631, "fp": 2076, "fn": 1152, "tn": 154, "precision": 0.44, "recall": 0.5861, "f2_score": 55.0, "f3_score": 56.7, "cvss_precision": 0.4802, "cvss_recall": 0.6013, "cvss_f3_score": 58.7 }, "strict_micro": { "tp": 1631, "fp": 2076, "fn": 1269, "tn": 154, "precision": 0.44, "recall": 0.5624, "f2_score": 53.3, "f3_score": 54.7, "cvss_precision": 0.4802, "cvss_recall": 0.5761, "cvss_f3_score": 56.5 }, "macro": { "f2_score": 55.2 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 4 }, "high": { "tp": 1192, "fp": 0, "fn": 827 }, "medium": { "tp": 354, "fp": 5, "fn": 312 }, "low": { "tp": 20, "fp": 0, "fn": 9 } }, "repos_scored": 87, "repos_total": 90, "f2_stddev": 10.2, "num_runs": 1 }, "gpt-5.5-agentic-v1": { "micro": { "tp": 643, "fp": 320, "fn": 556, "tn": 159, "precision": 0.6677, "recall": 0.5363, "f2_score": 55.8, "f3_score": 54.7, "cvss_precision": 0.7704, "cvss_recall": 0.5727, "cvss_f3_score": 58.8 }, "strict_micro": { "tp": 643, "fp": 320, "fn": 2257, "tn": 159, "precision": 0.6677, "recall": 0.2217, "f2_score": 25.6, "f3_score": 23.8, "cvss_precision": 0.7704, "cvss_recall": 0.2241, "cvss_f3_score": 24.1 }, "macro": { "f2_score": 55.8 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 293, "fp": 0, "fn": 194 }, "medium": { "tp": 259, "fp": 1, "fn": 368 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.6, "num_runs": 3 }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 505, "fp": 130, "fn": 694, "tn": 157, "precision": 0.7953, "recall": 0.4212, "f2_score": 46.5, "f3_score": 44.2, "cvss_precision": 0.8642, "cvss_recall": 0.4497, "cvss_f3_score": 47.2 }, "strict_micro": { "tp": 505, "fp": 130, "fn": 2395, "tn": 157, "precision": 0.7953, "recall": 0.1741, "f2_score": 20.6, "f3_score": 18.9, "cvss_precision": 0.8642, "cvss_recall": 0.176, "cvss_f3_score": 19.1 }, "macro": { "f2_score": 46.5 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 4 }, "high": { "tp": 221, "fp": 0, "fn": 266 }, "medium": { "tp": 209, "fp": 2, "fn": 418 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 12.6, "num_runs": 1 }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 2320, "fp": 1631, "fn": 580, "tn": 157, "precision": 0.5872, "recall": 0.8, "f2_score": 74.6, "f3_score": 77.2, "cvss_precision": 0.6018, "cvss_recall": 0.806, "cvss_f3_score": 78.0 }, "strict_micro": { "tp": 2320, "fp": 1631, "fn": 580, "tn": 157, "precision": 0.5872, "recall": 0.8, "f2_score": 74.6, "f3_score": 77.2, "cvss_precision": 0.6018, "cvss_recall": 0.806, "cvss_f3_score": 78.0 }, "macro": { "f2_score": 74.3 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 1677, "fp": 1, "fn": 455 }, "medium": { "tp": 550, "fp": 1, "fn": 118 }, "low": { "tp": 25, "fp": 0, "fn": 4 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 21.1, "num_runs": 1 }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 561, "fp": 212, "fn": 638, "tn": 158, "precision": 0.7257, "recall": 0.4679, "f2_score": 50.4, "f3_score": 48.5, "cvss_precision": 0.7918, "cvss_recall": 0.5103, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 561, "fp": 212, "fn": 2339, "tn": 158, "precision": 0.7257, "recall": 0.1934, "f2_score": 22.7, "f3_score": 20.9, "cvss_precision": 0.7918, "cvss_recall": 0.1997, "cvss_f3_score": 21.6 }, "macro": { "f2_score": 50.5 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 277, "fp": 0, "fn": 210 }, "medium": { "tp": 203, "fp": 1, "fn": 424 }, "low": { "tp": 16, "fp": 0, "fn": 2 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 10.2, "num_runs": 1 }, "gpt-6-astra-codex-cli": { "micro": { "tp": 1571, "fp": 2053, "fn": 1329, "tn": 156, "precision": 0.4335, "recall": 0.5417, "f2_score": 51.6, "f3_score": 52.9, "cvss_precision": 0.4567, "cvss_recall": 0.5722, "cvss_f3_score": 55.8 }, "strict_micro": { "tp": 1571, "fp": 2053, "fn": 1329, "tn": 156, "precision": 0.4335, "recall": 0.5417, "f2_score": 51.6, "f3_score": 52.9, "cvss_precision": 0.4567, "cvss_recall": 0.5722, "cvss_f3_score": 55.8 }, "macro": { "f2_score": 50.6 }, "per_severity": { "critical": { "tp": 61, "fp": 0, "fn": 10 }, "high": { "tp": 1273, "fp": 1, "fn": 859 }, "medium": { "tp": 219, "fp": 2, "fn": 449 }, "low": { "tp": 18, "fp": 0, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 9.4, "num_runs": 1 }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 2474, "fp": 1412, "fn": 426, "tn": 158, "precision": 0.6366, "recall": 0.8531, "f2_score": 79.9, "f3_score": 82.5, "cvss_precision": 0.6486, "cvss_recall": 0.8541, "cvss_f3_score": 82.8 }, "strict_micro": { "tp": 2474, "fp": 1412, "fn": 426, "tn": 158, "precision": 0.6366, "recall": 0.8531, "f2_score": 79.9, "f3_score": 82.5, "cvss_precision": 0.6486, "cvss_recall": 0.8541, "cvss_f3_score": 82.8 }, "macro": { "f2_score": 79.7 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 1793, "fp": 0, "fn": 339 }, "medium": { "tp": 588, "fp": 1, "fn": 80 }, "low": { "tp": 25, "fp": 0, "fn": 4 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 18.5, "num_runs": 1 }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 499, "fp": 165, "fn": 699, "tn": 157, "precision": 0.7515, "recall": 0.4165, "f2_score": 45.7, "f3_score": 43.6, "cvss_precision": 0.8295, "cvss_recall": 0.4336, "cvss_f3_score": 45.5 }, "strict_micro": { "tp": 499, "fp": 165, "fn": 2400, "tn": 157, "precision": 0.7515, "recall": 0.1721, "f2_score": 20.4, "f3_score": 18.7, "cvss_precision": 0.8295, "cvss_recall": 0.1697, "cvss_f3_score": 18.4 }, "macro": { "f2_score": 45.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 206, "fp": 1, "fn": 281 }, "medium": { "tp": 217, "fp": 2, "fn": 410 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.1, "num_runs": 3 }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 519, "fp": 210, "fn": 681, "tn": 159, "precision": 0.7119, "recall": 0.4325, "f2_score": 46.9, "f3_score": 45.0, "cvss_precision": 0.8217, "cvss_recall": 0.4574, "cvss_f3_score": 47.9 }, "strict_micro": { "tp": 519, "fp": 210, "fn": 2382, "tn": 159, "precision": 0.7119, "recall": 0.1789, "f2_score": 21.0, "f3_score": 19.3, "cvss_precision": 0.8217, "cvss_recall": 0.179, "cvss_f3_score": 19.4 }, "macro": { "f2_score": 46.8 }, "per_severity": { "critical": { "tp": 61, "fp": 0, "fn": 6 }, "high": { "tp": 222, "fp": 0, "fn": 265 }, "medium": { "tp": 209, "fp": 0, "fn": 418 }, "low": { "tp": 17, "fp": 0, "fn": 1 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 10.5, "num_runs": 3 }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 580, "fp": 290, "fn": 618, "tn": 158, "precision": 0.6667, "recall": 0.4841, "f2_score": 51.2, "f3_score": 49.8, "cvss_precision": 0.8087, "cvss_recall": 0.5151, "cvss_f3_score": 53.4 }, "strict_micro": { "tp": 580, "fp": 290, "fn": 2319, "tn": 158, "precision": 0.6667, "recall": 0.2001, "f2_score": 23.3, "f3_score": 21.5, "cvss_precision": 0.8087, "cvss_recall": 0.2015, "cvss_f3_score": 21.8 }, "macro": { "f2_score": 51.2 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 1 }, "high": { "tp": 248, "fp": 0, "fn": 239 }, "medium": { "tp": 248, "fp": 3, "fn": 379 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.3, "num_runs": 3 }, "kimi-k3-agentic-v1": { "micro": { "tp": 709, "fp": 316, "fn": 490, "tn": 158, "precision": 0.6917, "recall": 0.5913, "f2_score": 60.9, "f3_score": 60.0, "cvss_precision": 0.81, "cvss_recall": 0.6103, "cvss_f3_score": 62.6 }, "strict_micro": { "tp": 709, "fp": 316, "fn": 2191, "tn": 158, "precision": 0.6917, "recall": 0.2445, "f2_score": 28.1, "f3_score": 26.1, "cvss_precision": 0.81, "cvss_recall": 0.2388, "cvss_f3_score": 25.7 }, "macro": { "f2_score": 61.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 310, "fp": 0, "fn": 177 }, "medium": { "tp": 316, "fp": 1, "fn": 311 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 9.5, "num_runs": 1 }, "kolega-ca-cc-sonnet": { "micro": { "tp": 574, "fp": 310, "fn": 625, "tn": 145, "precision": 0.6493, "recall": 0.4787, "f2_score": 50.5, "f3_score": 49.2, "cvss_precision": 0.6666, "cvss_recall": 0.5024, "cvss_f3_score": 51.5 }, "strict_micro": { "tp": 574, "fp": 310, "fn": 2326, "tn": 145, "precision": 0.6493, "recall": 0.1979, "f2_score": 23.0, "f3_score": 21.3, "cvss_precision": 0.6666, "cvss_recall": 0.1966, "cvss_f3_score": 21.2 }, "macro": { "f2_score": 50.1 }, "per_severity": { "critical": { "tp": 57, "fp": 0, "fn": 10 }, "high": { "tp": 265, "fp": 1, "fn": 222 }, "medium": { "tp": 244, "fp": 13, "fn": 383 }, "low": { "tp": 8, "fp": 0, "fn": 10 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 18.1, "num_runs": 1 }, "kolega-claude-adaptation": { "micro": { "tp": 945, "fp": 2130, "fn": 254, "tn": 144, "precision": 0.3073, "recall": 0.7882, "f2_score": 60.0, "f3_score": 68.2, "cvss_precision": 0.2823, "cvss_recall": 0.7986, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 945, "fp": 2130, "fn": 1955, "tn": 144, "precision": 0.3073, "recall": 0.3259, "f2_score": 32.2, "f3_score": 32.4, "cvss_precision": 0.2823, "cvss_recall": 0.3125, "cvss_f3_score": 30.9 }, "macro": { "f2_score": 59.8 }, "per_severity": { "critical": { "tp": 64, "fp": 0, "fn": 3 }, "high": { "tp": 379, "fp": 7, "fn": 108 }, "medium": { "tp": 484, "fp": 7, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.6, "num_runs": 1 }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 865, "fp": 1144, "fn": 334, "tn": 148, "precision": 0.4306, "recall": 0.7214, "f2_score": 63.6, "f3_score": 67.6, "cvss_precision": 0.3979, "cvss_recall": 0.7412, "cvss_f3_score": 68.2 }, "strict_micro": { "tp": 865, "fp": 1144, "fn": 2035, "tn": 148, "precision": 0.4306, "recall": 0.2983, "f2_score": 31.8, "f3_score": 30.8, "cvss_precision": 0.3979, "cvss_recall": 0.29, "cvss_f3_score": 29.8 }, "macro": { "f2_score": 63.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 357, "fp": 5, "fn": 130 }, "medium": { "tp": 427, "fp": 5, "fn": 200 }, "low": { "tp": 14, "fp": 1, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 8.1, "num_runs": 1 }, "kolega-claude-adaptation-v1": { "micro": { "tp": 110, "fp": 58, "fn": 1089, "tn": 158, "precision": 0.6548, "recall": 0.0917, "f2_score": 11.1, "f3_score": 10.0, "cvss_precision": 0.6362, "cvss_recall": 0.1049, "cvss_f3_score": 11.4 }, "strict_micro": { "tp": 110, "fp": 58, "fn": 2790, "tn": 158, "precision": 0.6548, "recall": 0.0379, "f2_score": 4.7, "f3_score": 4.2, "cvss_precision": 0.6362, "cvss_recall": 0.041, "cvss_f3_score": 4.5 }, "macro": { "f2_score": 10.8 }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 66 }, "high": { "tp": 76, "fp": 1, "fn": 411 }, "medium": { "tp": 30, "fp": 0, "fn": 597 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.5, "num_runs": 1 }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 939, "fp": 2035, "fn": 260, "tn": 144, "precision": 0.3157, "recall": 0.7832, "f2_score": 60.4, "f3_score": 68.2, "cvss_precision": 0.2826, "cvss_recall": 0.7921, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 939, "fp": 2035, "fn": 1961, "tn": 144, "precision": 0.3157, "recall": 0.3238, "f2_score": 32.2, "f3_score": 32.3, "cvss_precision": 0.2826, "cvss_recall": 0.3099, "cvss_f3_score": 30.7 }, "macro": { "f2_score": 60.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 381, "fp": 4, "fn": 106 }, "medium": { "tp": 473, "fp": 10, "fn": 154 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.5, "num_runs": 1 }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 2644, "fp": 2437, "fn": 256, "tn": 151, "precision": 0.5204, "recall": 0.9117, "f2_score": 79.3, "f3_score": 84.8, "cvss_precision": 0.4699, "cvss_recall": 0.9148, "cvss_f3_score": 83.6 }, "strict_micro": { "tp": 2644, "fp": 2437, "fn": 256, "tn": 151, "precision": 0.5204, "recall": 0.9117, "f2_score": 79.3, "f3_score": 84.8, "cvss_precision": 0.4699, "cvss_recall": 0.9148, "cvss_f3_score": 83.6 }, "macro": { "f2_score": 79.4 }, "per_severity": { "critical": { "tp": 69, "fp": 0, "fn": 2 }, "high": { "tp": 1956, "fp": 3, "fn": 176 }, "medium": { "tp": 600, "fp": 5, "fn": 68 }, "low": { "tp": 19, "fp": 0, "fn": 10 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 8.1, "num_runs": 1 }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 625, "fp": 819, "fn": 574, "tn": 157, "precision": 0.4328, "recall": 0.5213, "f2_score": 50.1, "f3_score": 51.1, "cvss_precision": 0.4364, "cvss_recall": 0.5452, "cvss_f3_score": 53.2 }, "strict_micro": { "tp": 625, "fp": 819, "fn": 2275, "tn": 157, "precision": 0.4328, "recall": 0.2155, "f2_score": 24.0, "f3_score": 22.7, "cvss_precision": 0.4364, "cvss_recall": 0.2134, "cvss_f3_score": 22.5 }, "macro": { "f2_score": 49.3 }, "per_severity": { "critical": { "tp": 53, "fp": 0, "fn": 14 }, "high": { "tp": 257, "fp": 1, "fn": 230 }, "medium": { "tp": 303, "fp": 1, "fn": 324 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 13.7, "num_runs": 1 }, "kolega-v0.0.2-raw": { "micro": { "tp": 954, "fp": 2945, "fn": 245, "tn": 144, "precision": 0.2447, "recall": 0.7957, "f2_score": 54.9, "f3_score": 64.9, "cvss_precision": 0.2244, "cvss_recall": 0.8055, "cvss_f3_score": 64.0 }, "strict_micro": { "tp": 954, "fp": 2945, "fn": 1946, "tn": 144, "precision": 0.2447, "recall": 0.329, "f2_score": 30.8, "f3_score": 31.8, "cvss_precision": 0.2244, "cvss_recall": 0.3152, "cvss_f3_score": 30.3 }, "macro": { "f2_score": 55.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 385, "fp": 4, "fn": 102 }, "medium": { "tp": 484, "fp": 10, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.5, "num_runs": 1 }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 256, "fp": 184, "fn": 800, "tn": 132, "precision": 0.5818, "recall": 0.2424, "f2_score": 27.4, "f3_score": 25.7, "cvss_precision": 0.6601, "cvss_recall": 0.2716, "cvss_f3_score": 28.9 }, "strict_micro": { "tp": 256, "fp": 184, "fn": 2645, "tn": 152, "precision": 0.5818, "recall": 0.0882, "f2_score": 10.6, "f3_score": 9.6, "cvss_precision": 0.6601, "cvss_recall": 0.0935, "cvss_f3_score": 10.2 }, "macro": { "f2_score": 27.8 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 24 }, "high": { "tp": 120, "fp": 3, "fn": 307 }, "medium": { "tp": 75, "fp": 8, "fn": 480 }, "low": { "tp": 3, "fp": 0, "fn": 11 } }, "repos_scored": 35, "repos_total": 90, "f2_stddev": 14.1, "num_runs": 3 }, "ornith-q3-agentic-v1": { "micro": { "tp": 224, "fp": 208, "fn": 860, "tn": 136, "precision": 0.5185, "recall": 0.2066, "f2_score": 23.5, "f3_score": 22.0, "cvss_precision": 0.5971, "cvss_recall": 0.2218, "cvss_f3_score": 23.7 }, "strict_micro": { "tp": 224, "fp": 208, "fn": 2676, "tn": 152, "precision": 0.5185, "recall": 0.0772, "f2_score": 9.3, "f3_score": 8.4, "cvss_precision": 0.5971, "cvss_recall": 0.0782, "cvss_f3_score": 8.6 }, "macro": { "f2_score": 21.6 }, "per_severity": { "critical": { "tp": 24, "fp": 0, "fn": 36 }, "high": { "tp": 101, "fp": 3, "fn": 334 }, "medium": { "tp": 96, "fp": 4, "fn": 475 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 36, "repos_total": 90, "f2_stddev": 21.7, "num_runs": 1 }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 402, "fp": 305, "fn": 797, "tn": 152, "precision": 0.5686, "recall": 0.3353, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6687, "cvss_recall": 0.3572, "cvss_f3_score": 37.5 }, "strict_micro": { "tp": 402, "fp": 305, "fn": 2498, "tn": 152, "precision": 0.5686, "recall": 0.1386, "f2_score": 16.3, "f3_score": 15.0, "cvss_precision": 0.6687, "cvss_recall": 0.1398, "cvss_f3_score": 15.2 }, "macro": { "f2_score": 36.2 }, "per_severity": { "critical": { "tp": 50, "fp": 0, "fn": 17 }, "high": { "tp": 172, "fp": 1, "fn": 315 }, "medium": { "tp": 174, "fp": 6, "fn": 453 }, "low": { "tp": 6, "fp": 0, "fn": 12 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 19.5, "num_runs": 1 }, "rowan": { "micro": { "tp": 297, "fp": 1272, "fn": 902, "tn": 144, "precision": 0.1893, "recall": 0.2477, "f2_score": 23.3, "f3_score": 24.0, "cvss_precision": 0.279, "cvss_recall": 0.2713, "cvss_f3_score": 27.2 }, "strict_micro": { "tp": 297, "fp": 1272, "fn": 2603, "tn": 144, "precision": 0.1893, "recall": 0.1024, "f2_score": 11.3, "f3_score": 10.7, "cvss_precision": 0.279, "cvss_recall": 0.1062, "cvss_f3_score": 11.3 }, "macro": { "f2_score": 23.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 101, "fp": 13, "fn": 386 }, "medium": { "tp": 129, "fp": 2, "fn": 498 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.3, "num_runs": 1 }, "semgrep": { "micro": { "tp": 190, "fp": 1701, "fn": 2710, "tn": 159, "precision": 0.1005, "recall": 0.0655, "f2_score": 7.0, "f3_score": 6.8, "cvss_precision": 0.1233, "cvss_recall": 0.0765, "cvss_f3_score": 7.9 }, "strict_micro": { "tp": 190, "fp": 1701, "fn": 2710, "tn": 159, "precision": 0.1005, "recall": 0.0655, "f2_score": 7.0, "f3_score": 6.8, "cvss_precision": 0.1233, "cvss_recall": 0.0765, "cvss_f3_score": 7.9 }, "macro": { "f2_score": 6.0 }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 71 }, "high": { "tp": 189, "fp": 0, "fn": 1943 }, "medium": { "tp": 1, "fp": 0, "fn": 667 }, "low": { "tp": 0, "fp": 0, "fn": 29 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 6.8, "num_runs": 1 }, "sonarqube": { "micro": { "tp": 230, "fp": 1559, "fn": 969, "tn": 159, "precision": 0.1286, "recall": 0.1918, "f2_score": 17.5, "f3_score": 18.3, "cvss_precision": 0.1361, "cvss_recall": 0.1935, "cvss_f3_score": 18.6 }, "strict_micro": { "tp": 230, "fp": 1559, "fn": 2670, "tn": 159, "precision": 0.1286, "recall": 0.0793, "f2_score": 8.6, "f3_score": 8.2, "cvss_precision": 0.1361, "cvss_recall": 0.0757, "cvss_f3_score": 7.9 }, "macro": { "f2_score": 18.2 }, "per_severity": { "critical": { "tp": 31, "fp": 0, "fn": 36 }, "high": { "tp": 77, "fp": 0, "fn": 410 }, "medium": { "tp": 122, "fp": 0, "fn": 505 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 5.4, "num_runs": 1 } } }, "source_repos": { "intentional": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvna", "realvuln-dvpwa", "realvuln-dvws-node", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-lets-be-bad-guys", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-api", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnerable-tornado-app", "realvuln-vulnnodeapp", "realvuln-vulnpy", "realvuln-vulpy", "realvuln-xvna" ], "vibe": [ "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ] }, "tab_aggregates": { "all": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 1301, "fp": 799, "fn": 601, "tn": 274, "precision": 0.6195, "recall": 0.684, "f2_score": 67.0, "f3_score": 67.7, "cvss_precision": 0.6729, "cvss_recall": 0.7047, "cvss_f3_score": 70.1 }, "strict_micro": { "tp": 1301, "fp": 799, "fn": 2837, "tn": 274, "precision": 0.6195, "recall": 0.3144, "f2_score": 34.9, "f3_score": 33.1, "cvss_precision": 0.6729, "cvss_recall": 0.3162, "cvss_f3_score": 33.4 }, "macro": { "f2_score": 68.4 }, "per_severity": { "critical": { "tp": 145, "fp": 2, "fn": 9 }, "high": { "tp": 524, "fp": 2, "fn": 228 }, "low": { "tp": 53, "fp": 0, "fn": 33 }, "medium": { "tp": 579, "fp": 2, "fn": 331 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 11.8, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 90.6769, "successful_runs": 66, "cost_per_run": 1.3739, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0678 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 1758, "fp": 1581, "fn": 2380, "tn": 275, "precision": 0.5265, "recall": 0.4248, "f2_score": 44.2, "f3_score": 43.3, "cvss_precision": 0.5749, "cvss_recall": 0.4486, "cvss_f3_score": 45.9 }, "strict_micro": { "tp": 1758, "fp": 1581, "fn": 2380, "tn": 275, "precision": 0.5265, "recall": 0.4248, "f2_score": 44.2, "f3_score": 43.3, "cvss_precision": 0.5749, "cvss_recall": 0.4486, "cvss_f3_score": 45.9 }, "macro": { "f2_score": 45.4 }, "per_severity": { "critical": { "tp": 140, "fp": 1, "fn": 18 }, "high": { "tp": 1181, "fp": 1, "fn": 1667 }, "low": { "tp": 34, "fp": 0, "fn": 132 }, "medium": { "tp": 403, "fp": 3, "fn": 563 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 17.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 130.668, "successful_runs": 140, "cost_per_run": 0.9333, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0176 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 1683, "fp": 1306, "fn": 2455, "tn": 272, "precision": 0.5631, "recall": 0.4067, "f2_score": 43.1, "f3_score": 41.8, "cvss_precision": 0.613, "cvss_recall": 0.4315, "cvss_f3_score": 44.5 }, "strict_micro": { "tp": 1683, "fp": 1306, "fn": 2455, "tn": 272, "precision": 0.5631, "recall": 0.4067, "f2_score": 43.1, "f3_score": 41.8, "cvss_precision": 0.613, "cvss_recall": 0.4315, "cvss_f3_score": 44.5 }, "macro": { "f2_score": 45.5 }, "per_severity": { "critical": { "tp": 147, "fp": 0, "fn": 11 }, "high": { "tp": 1105, "fp": 1, "fn": 1743 }, "low": { "tp": 49, "fp": 2, "fn": 117 }, "medium": { "tp": 379, "fp": 3, "fn": 587 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 18.0, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 3.8336, "successful_runs": 188, "cost_per_run": 0.0204, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0005 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 1507, "fp": 967, "fn": 2630, "tn": 275, "precision": 0.6091, "recall": 0.3643, "f2_score": 39.6, "f3_score": 38.0, "cvss_precision": 0.6686, "cvss_recall": 0.3875, "cvss_f3_score": 40.4 }, "strict_micro": { "tp": 1507, "fp": 967, "fn": 2630, "tn": 275, "precision": 0.6091, "recall": 0.3643, "f2_score": 39.6, "f3_score": 38.0, "cvss_precision": 0.6686, "cvss_recall": 0.3875, "cvss_f3_score": 40.4 }, "macro": { "f2_score": 40.8 }, "per_severity": { "critical": { "tp": 140, "fp": 2, "fn": 18 }, "high": { "tp": 968, "fp": 1, "fn": 1880 }, "low": { "tp": 43, "fp": 0, "fn": 123 }, "medium": { "tp": 359, "fp": 2, "fn": 607 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 20.6, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 15.0775, "successful_runs": 185, "cost_per_run": 0.0815, "total_loc_scanned": 741034, "cost_per_100_loc": 0.002 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 2099, "fp": 1911, "fn": 2039, "tn": 275, "precision": 0.5234, "recall": 0.5072, "f2_score": 51.0, "f3_score": 50.9, "cvss_precision": 0.5535, "cvss_recall": 0.5248, "cvss_f3_score": 52.8 }, "strict_micro": { "tp": 2099, "fp": 1911, "fn": 2039, "tn": 275, "precision": 0.5234, "recall": 0.5072, "f2_score": 51.0, "f3_score": 50.9, "cvss_precision": 0.5535, "cvss_recall": 0.5248, "cvss_f3_score": 52.8 }, "macro": { "f2_score": 52.2 }, "per_severity": { "critical": { "tp": 143, "fp": 0, "fn": 15 }, "high": { "tp": 1430, "fp": 0, "fn": 1418 }, "low": { "tp": 45, "fp": 0, "fn": 121 }, "medium": { "tp": 481, "fp": 5, "fn": 485 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 17.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 140, "cost_per_run": 0.0, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 614, "fp": 70, "fn": 1232, "tn": 269, "precision": 0.8977, "recall": 0.3326, "f2_score": 38.1, "f3_score": 35.5, "cvss_precision": 0.9146, "cvss_recall": 0.366, "cvss_f3_score": 38.9 }, "strict_micro": { "tp": 614, "fp": 70, "fn": 3525, "tn": 277, "precision": 0.8977, "recall": 0.1483, "f2_score": 17.8, "f3_score": 16.2, "cvss_precision": 0.9146, "cvss_recall": 0.1593, "cvss_f3_score": 17.4 }, "macro": { "f2_score": 39.8 }, "per_severity": { "critical": { "tp": 125, "fp": 0, "fn": 23 }, "high": { "tp": 284, "fp": 2, "fn": 448 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 194, "fp": 1, "fn": 687 } }, "repos_scored": 64, "repos_total": 140, "f2_stddev": 11.7, "num_runs": 3, "language_coverage": { "python": [ 64, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 81.0473, "successful_runs": 147, "cost_per_run": 0.5513, "total_loc_scanned": 131215, "cost_per_100_loc": 0.027 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 447, "fp": 49, "fn": 1455, "tn": 277, "precision": 0.9012, "recall": 0.235, "f2_score": 27.6, "f3_score": 25.4, "cvss_precision": 0.9468, "cvss_recall": 0.2695, "cvss_f3_score": 29.0 }, "strict_micro": { "tp": 447, "fp": 49, "fn": 3691, "tn": 277, "precision": 0.9012, "recall": 0.108, "f2_score": 13.1, "f3_score": 11.8, "cvss_precision": 0.9468, "cvss_recall": 0.1209, "cvss_f3_score": 13.2 }, "macro": { "f2_score": 29.2 }, "per_severity": { "critical": { "tp": 98, "fp": 1, "fn": 56 }, "high": { "tp": 219, "fp": 1, "fn": 533 }, "low": { "tp": 6, "fp": 0, "fn": 80 }, "medium": { "tp": 124, "fp": 1, "fn": 786 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 18.7, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 66, "cost_per_run": 0.0, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 620, "fp": 183, "fn": 1116, "tn": 249, "precision": 0.7721, "recall": 0.3571, "f2_score": 40.0, "f3_score": 37.7, "cvss_precision": 0.8206, "cvss_recall": 0.3859, "cvss_f3_score": 40.8 }, "strict_micro": { "tp": 620, "fp": 183, "fn": 3518, "tn": 278, "precision": 0.7721, "recall": 0.1498, "f2_score": 17.9, "f3_score": 16.3, "cvss_precision": 0.8206, "cvss_recall": 0.1569, "cvss_f3_score": 17.1 }, "macro": { "f2_score": 41.0 }, "per_severity": { "critical": { "tp": 104, "fp": 1, "fn": 34 }, "high": { "tp": 268, "fp": 0, "fn": 428 }, "low": { "tp": 9, "fp": 0, "fn": 54 }, "medium": { "tp": 233, "fp": 1, "fn": 606 } }, "repos_scored": 62, "repos_total": 140, "f2_stddev": 21.9, "num_runs": 3, "language_coverage": { "python": [ 62, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 13.8959, "successful_runs": 186, "cost_per_run": 0.0747, "total_loc_scanned": 129077, "cost_per_100_loc": 0.0036 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 854, "fp": 314, "fn": 1033, "tn": 272, "precision": 0.7312, "recall": 0.4526, "f2_score": 49.0, "f3_score": 47.0, "cvss_precision": 0.8011, "cvss_recall": 0.4798, "cvss_f3_score": 50.0 }, "strict_micro": { "tp": 854, "fp": 314, "fn": 3284, "tn": 276, "precision": 0.7312, "recall": 0.2064, "f2_score": 24.1, "f3_score": 22.2, "cvss_precision": 0.8011, "cvss_recall": 0.2133, "cvss_f3_score": 23.0 }, "macro": { "f2_score": 49.6 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 25 }, "high": { "tp": 363, "fp": 3, "fn": 383 }, "low": { "tp": 36, "fp": 0, "fn": 48 }, "medium": { "tp": 335, "fp": 2, "fn": 569 } }, "repos_scored": 65, "repos_total": 140, "f2_stddev": 26.3, "num_runs": 3, "language_coverage": { "python": [ 65, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 32.6591, "successful_runs": 195, "cost_per_run": 0.1675, "total_loc_scanned": 133330, "cost_per_100_loc": 0.0082 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 815, "fp": 454, "fn": 1087, "tn": 277, "precision": 0.6422, "recall": 0.4285, "f2_score": 45.9, "f3_score": 44.3, "cvss_precision": 0.7439, "cvss_recall": 0.4584, "cvss_f3_score": 47.7 }, "strict_micro": { "tp": 815, "fp": 454, "fn": 3323, "tn": 277, "precision": 0.6422, "recall": 0.197, "f2_score": 22.9, "f3_score": 21.2, "cvss_precision": 0.7439, "cvss_recall": 0.2057, "cvss_f3_score": 22.2 }, "macro": { "f2_score": 46.1 }, "per_severity": { "critical": { "tp": 119, "fp": 2, "fn": 35 }, "high": { "tp": 353, "fp": 1, "fn": 399 }, "low": { "tp": 36, "fp": 0, "fn": 50 }, "medium": { "tp": 343, "fp": 1, "fn": 567 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 24.8, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 28.5574, "successful_runs": 197, "cost_per_run": 0.145, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0072 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 2315, "fp": 2842, "fn": 1629, "tn": 272, "precision": 0.4489, "recall": 0.587, "f2_score": 55.3, "f3_score": 56.9, "cvss_precision": 0.4948, "cvss_recall": 0.6073, "cvss_f3_score": 59.4 }, "strict_micro": { "tp": 2315, "fp": 2842, "fn": 1823, "tn": 272, "precision": 0.4489, "recall": 0.5594, "f2_score": 53.3, "f3_score": 54.6, "cvss_precision": 0.4948, "cvss_recall": 0.5786, "cvss_f3_score": 56.9 }, "macro": { "f2_score": 56.2 }, "per_severity": { "critical": { "tp": 146, "fp": 2, "fn": 10 }, "high": { "tp": 1581, "fp": 0, "fn": 1101 }, "low": { "tp": 57, "fp": 0, "fn": 87 }, "medium": { "tp": 531, "fp": 6, "fn": 431 } }, "repos_scored": 136, "repos_total": 140, "f2_stddev": 14.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 70, 74 ] }, "cost": { "total_cost": 105.7309, "successful_runs": 136, "cost_per_run": 0.7774, "total_loc_scanned": 713729, "cost_per_100_loc": 0.0148 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 1053, "fp": 397, "fn": 849, "tn": 280, "precision": 0.7262, "recall": 0.5536, "f2_score": 58.1, "f3_score": 56.7, "cvss_precision": 0.8156, "cvss_recall": 0.5951, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 1053, "fp": 397, "fn": 3085, "tn": 280, "precision": 0.7262, "recall": 0.2545, "f2_score": 29.2, "f3_score": 27.2, "cvss_precision": 0.8156, "cvss_recall": 0.267, "cvss_f3_score": 28.6 }, "macro": { "f2_score": 59.7 }, "per_severity": { "critical": { "tp": 146, "fp": 1, "fn": 8 }, "high": { "tp": 455, "fp": 0, "fn": 297 }, "low": { "tp": 41, "fp": 0, "fn": 45 }, "medium": { "tp": 412, "fp": 1, "fn": 498 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 12.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 144.1409, "successful_runs": 196, "cost_per_run": 0.7354, "total_loc_scanned": 133782, "cost_per_100_loc": 0.036 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 760, "fp": 168, "fn": 1142, "tn": 278, "precision": 0.819, "recall": 0.3996, "f2_score": 44.5, "f3_score": 42.1, "cvss_precision": 0.8825, "cvss_recall": 0.4339, "cvss_f3_score": 45.7 }, "strict_micro": { "tp": 760, "fp": 168, "fn": 3378, "tn": 278, "precision": 0.819, "recall": 0.1837, "f2_score": 21.7, "f3_score": 19.9, "cvss_precision": 0.8825, "cvss_recall": 0.1947, "cvss_f3_score": 21.1 }, "macro": { "f2_score": 46.7 }, "per_severity": { "critical": { "tp": 128, "fp": 0, "fn": 26 }, "high": { "tp": 334, "fp": 0, "fn": 418 }, "low": { "tp": 15, "fp": 0, "fn": 71 }, "medium": { "tp": 283, "fp": 2, "fn": 627 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 1.0844, "successful_runs": 66, "cost_per_run": 0.0164, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0008 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 3183, "fp": 2182, "fn": 955, "tn": 277, "precision": 0.5933, "recall": 0.7692, "f2_score": 72.6, "f3_score": 74.7, "cvss_precision": 0.6133, "cvss_recall": 0.7758, "cvss_f3_score": 75.6 }, "strict_micro": { "tp": 3183, "fp": 2182, "fn": 955, "tn": 277, "precision": 0.5933, "recall": 0.7692, "f2_score": 72.6, "f3_score": 74.7, "cvss_precision": 0.6133, "cvss_recall": 0.7758, "cvss_f3_score": 75.6 }, "macro": { "f2_score": 72.7 }, "per_severity": { "critical": { "tp": 145, "fp": 0, "fn": 13 }, "high": { "tp": 2196, "fp": 1, "fn": 652 }, "low": { "tp": 105, "fp": 0, "fn": 61 }, "medium": { "tp": 737, "fp": 2, "fn": 229 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 21.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 560.3368, "successful_runs": 140, "cost_per_run": 4.0024, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0756 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 886, "fp": 273, "fn": 1016, "tn": 279, "precision": 0.7645, "recall": 0.4658, "f2_score": 50.5, "f3_score": 48.5, "cvss_precision": 0.8262, "cvss_recall": 0.5087, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 886, "fp": 273, "fn": 3252, "tn": 279, "precision": 0.7645, "recall": 0.2141, "f2_score": 25.0, "f3_score": 23.1, "cvss_precision": 0.8262, "cvss_recall": 0.2283, "cvss_f3_score": 24.6 }, "macro": { "f2_score": 53.1 }, "per_severity": { "critical": { "tp": 137, "fp": 0, "fn": 17 }, "high": { "tp": 406, "fp": 0, "fn": 346 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 315, "fp": 1, "fn": 595 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 15.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 29.62, "successful_runs": 66, "cost_per_run": 0.4488, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0221 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 2197, "fp": 2715, "fn": 1941, "tn": 276, "precision": 0.4473, "recall": 0.5309, "f2_score": 51.2, "f3_score": 52.1, "cvss_precision": 0.476, "cvss_recall": 0.5619, "cvss_f3_score": 55.2 }, "strict_micro": { "tp": 2197, "fp": 2715, "fn": 1941, "tn": 276, "precision": 0.4473, "recall": 0.5309, "f2_score": 51.2, "f3_score": 52.1, "cvss_precision": 0.476, "cvss_recall": 0.5619, "cvss_f3_score": 55.2 }, "macro": { "f2_score": 52.0 }, "per_severity": { "critical": { "tp": 135, "fp": 0, "fn": 23 }, "high": { "tp": 1654, "fp": 1, "fn": 1194 }, "low": { "tp": 41, "fp": 0, "fn": 125 }, "medium": { "tp": 367, "fp": 3, "fn": 599 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 13.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 1040.6151, "successful_runs": 140, "cost_per_run": 7.433, "total_loc_scanned": 741034, "cost_per_100_loc": 0.1404 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 3383, "fp": 1905, "fn": 755, "tn": 278, "precision": 0.6398, "recall": 0.8175, "f2_score": 77.4, "f3_score": 79.5, "cvss_precision": 0.6574, "cvss_recall": 0.8196, "cvss_f3_score": 80.0 }, "strict_micro": { "tp": 3383, "fp": 1905, "fn": 755, "tn": 278, "precision": 0.6398, "recall": 0.8175, "f2_score": 77.4, "f3_score": 79.5, "cvss_precision": 0.6574, "cvss_recall": 0.8196, "cvss_f3_score": 80.0 }, "macro": { "f2_score": 77.5 }, "per_severity": { "critical": { "tp": 144, "fp": 0, "fn": 14 }, "high": { "tp": 2350, "fp": 0, "fn": 498 }, "low": { "tp": 113, "fp": 0, "fn": 53 }, "medium": { "tp": 776, "fp": 2, "fn": 190 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 19.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 547.5611, "successful_runs": 140, "cost_per_run": 3.9112, "total_loc_scanned": 741034, "cost_per_100_loc": 0.0739 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 842, "fp": 322, "fn": 1059, "tn": 269, "precision": 0.7234, "recall": 0.4429, "f2_score": 48.0, "f3_score": 46.1, "cvss_precision": 0.7945, "cvss_recall": 0.471, "cvss_f3_score": 49.1 }, "strict_micro": { "tp": 842, "fp": 322, "fn": 3295, "tn": 269, "precision": 0.7234, "recall": 0.2035, "f2_score": 23.8, "f3_score": 21.9, "cvss_precision": 0.7945, "cvss_recall": 0.2113, "cvss_f3_score": 22.8 }, "macro": { "f2_score": 49.1 }, "per_severity": { "critical": { "tp": 136, "fp": 1, "fn": 18 }, "high": { "tp": 336, "fp": 7, "fn": 416 }, "low": { "tp": 31, "fp": 0, "fn": 55 }, "medium": { "tp": 325, "fp": 2, "fn": 585 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.3, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 7.9565, "successful_runs": 192, "cost_per_run": 0.0414, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0021 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 908, "fp": 312, "fn": 995, "tn": 277, "precision": 0.7443, "recall": 0.4771, "f2_score": 51.4, "f3_score": 49.5, "cvss_precision": 0.8333, "cvss_recall": 0.5123, "cvss_f3_score": 53.3 }, "strict_micro": { "tp": 908, "fp": 312, "fn": 3231, "tn": 277, "precision": 0.7443, "recall": 0.2194, "f2_score": 25.5, "f3_score": 23.6, "cvss_precision": 0.8333, "cvss_recall": 0.2299, "cvss_f3_score": 24.8 }, "macro": { "f2_score": 52.5 }, "per_severity": { "critical": { "tp": 129, "fp": 1, "fn": 25 }, "high": { "tp": 365, "fp": 3, "fn": 387 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 338, "fp": 1, "fn": 572 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 14.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 21.0418, "successful_runs": 157, "cost_per_run": 0.134, "total_loc_scanned": 133329, "cost_per_100_loc": 0.0064 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 965, "fp": 464, "fn": 936, "tn": 276, "precision": 0.6753, "recall": 0.5076, "f2_score": 53.4, "f3_score": 52.1, "cvss_precision": 0.7922, "cvss_recall": 0.5467, "cvss_f3_score": 56.4 }, "strict_micro": { "tp": 965, "fp": 464, "fn": 3172, "tn": 276, "precision": 0.6753, "recall": 0.2333, "f2_score": 26.8, "f3_score": 25.0, "cvss_precision": 0.7922, "cvss_recall": 0.2453, "cvss_f3_score": 26.3 }, "macro": { "f2_score": 55.0 }, "per_severity": { "critical": { "tp": 139, "fp": 1, "fn": 15 }, "high": { "tp": 419, "fp": 1, "fn": 333 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 391, "fp": 4, "fn": 519 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.0, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 25.5527, "successful_runs": 187, "cost_per_run": 0.1366, "total_loc_scanned": 133782, "cost_per_100_loc": 0.007 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 1107, "fp": 409, "fn": 795, "tn": 277, "precision": 0.7302, "recall": 0.582, "f2_score": 60.7, "f3_score": 59.4, "cvss_precision": 0.8323, "cvss_recall": 0.6077, "cvss_f3_score": 62.5 }, "strict_micro": { "tp": 1107, "fp": 409, "fn": 3031, "tn": 277, "precision": 0.7302, "recall": 0.2675, "f2_score": 30.6, "f3_score": 28.6, "cvss_precision": 0.8323, "cvss_recall": 0.2727, "cvss_f3_score": 29.2 }, "macro": { "f2_score": 62.3 }, "per_severity": { "critical": { "tp": 142, "fp": 0, "fn": 12 }, "high": { "tp": 468, "fp": 2, "fn": 284 }, "low": { "tp": 46, "fp": 0, "fn": 40 }, "medium": { "tp": 451, "fp": 1, "fn": 459 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 21.3334, "successful_runs": 66, "cost_per_run": 0.3232, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0159 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 883, "fp": 437, "fn": 1019, "tn": 262, "precision": 0.6689, "recall": 0.4642, "f2_score": 49.5, "f3_score": 47.9, "cvss_precision": 0.6852, "cvss_recall": 0.4946, "cvss_f3_score": 50.9 }, "strict_micro": { "tp": 883, "fp": 437, "fn": 3255, "tn": 262, "precision": 0.6689, "recall": 0.2134, "f2_score": 24.7, "f3_score": 22.9, "cvss_precision": 0.6852, "cvss_recall": 0.2219, "cvss_f3_score": 23.8 }, "macro": { "f2_score": 51.4 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 26 }, "high": { "tp": 398, "fp": 3, "fn": 354 }, "low": { "tp": 23, "fp": 0, "fn": 63 }, "medium": { "tp": 334, "fp": 14, "fn": 576 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 16.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 290.6804, "successful_runs": 66, "cost_per_run": 4.4042, "total_loc_scanned": 133782, "cost_per_100_loc": 0.2173 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 1466, "fp": 3126, "fn": 436, "tn": 261, "precision": 0.3193, "recall": 0.7708, "f2_score": 60.1, "f3_score": 67.5, "cvss_precision": 0.3021, "cvss_recall": 0.7825, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 1466, "fp": 3126, "fn": 2672, "tn": 261, "precision": 0.3193, "recall": 0.3543, "f2_score": 34.7, "f3_score": 35.0, "cvss_precision": 0.3021, "cvss_recall": 0.3511, "cvss_f3_score": 34.6 }, "macro": { "f2_score": 60.5 }, "per_severity": { "critical": { "tp": 139, "fp": 2, "fn": 15 }, "high": { "tp": 576, "fp": 8, "fn": 176 }, "low": { "tp": 58, "fp": 1, "fn": 28 }, "medium": { "tp": 693, "fp": 8, "fn": 217 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 9.0, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 146.0, "successful_runs": 66, "cost_per_run": 2.2121, "total_loc_scanned": 133782, "cost_per_100_loc": 0.1091 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 1310, "fp": 1668, "fn": 592, "tn": 267, "precision": 0.4399, "recall": 0.6887, "f2_score": 61.9, "f3_score": 65.2, "cvss_precision": 0.4195, "cvss_recall": 0.7062, "cvss_f3_score": 66.1 }, "strict_micro": { "tp": 1310, "fp": 1668, "fn": 2828, "tn": 267, "precision": 0.4399, "recall": 0.3166, "f2_score": 33.5, "f3_score": 32.6, "cvss_precision": 0.4195, "cvss_recall": 0.3169, "cvss_f3_score": 32.5 }, "macro": { "f2_score": 63.0 }, "per_severity": { "critical": { "tp": 138, "fp": 0, "fn": 16 }, "high": { "tp": 529, "fp": 7, "fn": 223 }, "low": { "tp": 45, "fp": 1, "fn": 41 }, "medium": { "tp": 598, "fp": 5, "fn": 312 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 22.25, "successful_runs": 66, "cost_per_run": 0.3371, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0166 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 235, "fp": 120, "fn": 1667, "tn": 279, "precision": 0.662, "recall": 0.1236, "f2_score": 14.8, "f3_score": 13.4, "cvss_precision": 0.643, "cvss_recall": 0.1444, "cvss_f3_score": 15.6 }, "strict_micro": { "tp": 235, "fp": 120, "fn": 3903, "tn": 279, "precision": 0.662, "recall": 0.0568, "f2_score": 6.9, "f3_score": 6.3, "cvss_precision": 0.643, "cvss_recall": 0.0648, "cvss_f3_score": 7.1 }, "macro": { "f2_score": 16.3 }, "per_severity": { "critical": { "tp": 36, "fp": 0, "fn": 118 }, "high": { "tp": 129, "fp": 1, "fn": 623 }, "low": { "tp": 4, "fp": 0, "fn": 82 }, "medium": { "tp": 66, "fp": 0, "fn": 844 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 1525, "fp": 3180, "fn": 377, "tn": 247, "precision": 0.3241, "recall": 0.8018, "f2_score": 61.9, "f3_score": 69.9, "cvss_precision": 0.2963, "cvss_recall": 0.8146, "cvss_f3_score": 69.3 }, "strict_micro": { "tp": 1525, "fp": 3180, "fn": 2613, "tn": 247, "precision": 0.3241, "recall": 0.3685, "f2_score": 35.9, "f3_score": 36.4, "cvss_precision": 0.2963, "cvss_recall": 0.3655, "cvss_f3_score": 35.7 }, "macro": { "f2_score": 62.9 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 608, "fp": 10, "fn": 144 }, "low": { "tp": 64, "fp": 2, "fn": 22 }, "medium": { "tp": 702, "fp": 16, "fn": 208 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 8.5, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 3733, "fp": 3277, "fn": 405, "tn": 270, "precision": 0.5325, "recall": 0.9021, "f2_score": 79.2, "f3_score": 84.4, "cvss_precision": 0.4866, "cvss_recall": 0.9028, "cvss_f3_score": 83.2 }, "strict_micro": { "tp": 3733, "fp": 3277, "fn": 405, "tn": 270, "precision": 0.5325, "recall": 0.9021, "f2_score": 79.2, "f3_score": 84.4, "cvss_precision": 0.4866, "cvss_recall": 0.9028, "cvss_f3_score": 83.2 }, "macro": { "f2_score": 79.2 }, "per_severity": { "critical": { "tp": 145, "fp": 1, "fn": 13 }, "high": { "tp": 2586, "fp": 4, "fn": 262 }, "low": { "tp": 146, "fp": 0, "fn": 20 }, "medium": { "tp": 856, "fp": 5, "fn": 110 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 10.0, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 986, "fp": 1115, "fn": 916, "tn": 277, "precision": 0.4693, "recall": 0.5184, "f2_score": 50.8, "f3_score": 51.3, "cvss_precision": 0.4737, "cvss_recall": 0.5437, "cvss_f3_score": 53.6 }, "strict_micro": { "tp": 986, "fp": 1115, "fn": 3152, "tn": 277, "precision": 0.4693, "recall": 0.2383, "f2_score": 26.4, "f3_score": 25.1, "cvss_precision": 0.4737, "cvss_recall": 0.244, "cvss_f3_score": 25.6 }, "macro": { "f2_score": 52.0 }, "per_severity": { "critical": { "tp": 119, "fp": 0, "fn": 35 }, "high": { "tp": 407, "fp": 2, "fn": 345 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 427, "fp": 1, "fn": 483 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 15.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 1549, "fp": 4289, "fn": 353, "tn": 247, "precision": 0.2653, "recall": 0.8144, "f2_score": 57.6, "f3_score": 67.5, "cvss_precision": 0.2485, "cvss_recall": 0.8265, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 1549, "fp": 4289, "fn": 2589, "tn": 247, "precision": 0.2653, "recall": 0.3743, "f2_score": 34.6, "f3_score": 36.0, "cvss_precision": 0.2485, "cvss_recall": 0.3708, "cvss_f3_score": 35.3 }, "macro": { "f2_score": 58.8 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 613, "fp": 10, "fn": 139 }, "low": { "tp": 68, "fp": 2, "fn": 18 }, "medium": { "tp": 717, "fp": 16, "fn": 193 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 9.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 532, "fp": 294, "fn": 1227, "tn": 248, "precision": 0.6441, "recall": 0.3024, "f2_score": 33.8, "f3_score": 31.9, "cvss_precision": 0.7156, "cvss_recall": 0.3409, "cvss_f3_score": 36.0 }, "strict_micro": { "tp": 532, "fp": 294, "fn": 3607, "tn": 268, "precision": 0.6441, "recall": 0.1285, "f2_score": 15.3, "f3_score": 14.0, "cvss_precision": 0.7156, "cvss_recall": 0.142, "cvss_f3_score": 15.4 }, "macro": { "f2_score": 35.4 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 44 }, "high": { "tp": 239, "fp": 7, "fn": 453 }, "low": { "tp": 13, "fp": 0, "fn": 69 }, "medium": { "tp": 164, "fp": 10, "fn": 674 } }, "repos_scored": 61, "repos_total": 140, "f2_stddev": 16.2, "num_runs": 3, "language_coverage": { "python": [ 61, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 7.523, "successful_runs": 136, "cost_per_run": 0.0553, "total_loc_scanned": 116141, "cost_per_100_loc": 0.0032 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 417, "fp": 363, "fn": 1241, "tn": 232, "precision": 0.5346, "recall": 0.2515, "f2_score": 28.1, "f3_score": 26.6, "cvss_precision": 0.613, "cvss_recall": 0.2758, "cvss_f3_score": 29.2 }, "strict_micro": { "tp": 417, "fp": 363, "fn": 3721, "tn": 266, "precision": 0.5346, "recall": 0.1008, "f2_score": 12.0, "f3_score": 11.0, "cvss_precision": 0.613, "cvss_recall": 0.1079, "cvss_f3_score": 11.8 }, "macro": { "f2_score": 28.1 }, "per_severity": { "critical": { "tp": 70, "fp": 1, "fn": 69 }, "high": { "tp": 179, "fp": 6, "fn": 479 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 156, "fp": 7, "fn": 637 } }, "repos_scored": 58, "repos_total": 140, "f2_stddev": 24.8, "num_runs": 1, "language_coverage": { "python": [ 58, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 58, "cost_per_run": 0.0, "total_loc_scanned": 117112, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 674, "fp": 437, "fn": 1192, "tn": 260, "precision": 0.6067, "recall": 0.3612, "f2_score": 39.3, "f3_score": 37.6, "cvss_precision": 0.7016, "cvss_recall": 0.3906, "cvss_f3_score": 40.9 }, "strict_micro": { "tp": 674, "fp": 437, "fn": 3464, "tn": 264, "precision": 0.6067, "recall": 0.1629, "f2_score": 19.1, "f3_score": 17.6, "cvss_precision": 0.7016, "cvss_recall": 0.1716, "cvss_f3_score": 18.6 }, "macro": { "f2_score": 42.3 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 48 }, "high": { "tp": 292, "fp": 8, "fn": 446 }, "low": { "tp": 21, "fp": 1, "fn": 64 }, "medium": { "tp": 259, "fp": 6, "fn": 634 } }, "repos_scored": 65, "repos_total": 140, "f2_stddev": 21.4, "num_runs": 1, "language_coverage": { "python": [ 65, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 65, "cost_per_run": 0.0, "total_loc_scanned": 131775, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 445, "fp": 1737, "fn": 1422, "tn": 247, "precision": 0.2039, "recall": 0.2384, "f2_score": 23.1, "f3_score": 23.4, "cvss_precision": 0.3196, "cvss_recall": 0.2624, "cvss_f3_score": 26.7 }, "strict_micro": { "tp": 445, "fp": 1737, "fn": 3693, "tn": 254, "precision": 0.2039, "recall": 0.1075, "f2_score": 11.9, "f3_score": 11.3, "cvss_precision": 0.3196, "cvss_recall": 0.1151, "cvss_f3_score": 12.3 }, "macro": { "f2_score": 23.5 }, "per_severity": { "critical": { "tp": 118, "fp": 2, "fn": 31 }, "high": { "tp": 145, "fp": 20, "fn": 593 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 176, "fp": 4, "fn": 720 } }, "repos_scored": 64, "repos_total": 140, "f2_stddev": 9.1, "num_runs": 1, "language_coverage": { "python": [ 64, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 410, "fp": 3145, "fn": 3728, "tn": 275, "precision": 0.1153, "recall": 0.0991, "f2_score": 10.2, "f3_score": 10.0, "cvss_precision": 0.1393, "cvss_recall": 0.1145, "cvss_f3_score": 11.7 }, "strict_micro": { "tp": 410, "fp": 3145, "fn": 3728, "tn": 275, "precision": 0.1153, "recall": 0.0991, "f2_score": 10.2, "f3_score": 10.0, "cvss_precision": 0.1393, "cvss_recall": 0.1145, "cvss_f3_score": 11.7 }, "macro": { "f2_score": 9.9 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 117 }, "high": { "tp": 318, "fp": 4, "fn": 2530 }, "low": { "tp": 3, "fp": 0, "fn": 163 }, "medium": { "tp": 48, "fp": 1, "fn": 918 } }, "repos_scored": 140, "repos_total": 140, "f2_stddev": 11.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 274, "fp": 1587, "fn": 1628, "tn": 279, "precision": 0.1472, "recall": 0.1441, "f2_score": 14.5, "f3_score": 14.4, "cvss_precision": 0.1601, "cvss_recall": 0.1439, "cvss_f3_score": 14.5 }, "strict_micro": { "tp": 274, "fp": 1587, "fn": 3864, "tn": 279, "precision": 0.1472, "recall": 0.0662, "f2_score": 7.4, "f3_score": 7.0, "cvss_precision": 0.1601, "cvss_recall": 0.0645, "cvss_f3_score": 6.9 }, "macro": { "f2_score": 13.6 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 113 }, "high": { "tp": 91, "fp": 0, "fn": 661 }, "low": { "tp": 0, "fp": 0, "fn": 86 }, "medium": { "tp": 142, "fp": 1, "fn": 768 } }, "repos_scored": 66, "repos_total": 140, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ], "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "python": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 1301, "fp": 799, "fn": 601, "tn": 274, "precision": 0.6195, "recall": 0.684, "f2_score": 67.0, "f3_score": 67.7, "cvss_precision": 0.6729, "cvss_recall": 0.7047, "cvss_f3_score": 70.1 }, "strict_micro": { "tp": 1301, "fp": 799, "fn": 601, "tn": 274, "precision": 0.6195, "recall": 0.684, "f2_score": 67.0, "f3_score": 67.7, "cvss_precision": 0.6729, "cvss_recall": 0.7047, "cvss_f3_score": 70.1 }, "macro": { "f2_score": 68.4 }, "per_severity": { "critical": { "tp": 145, "fp": 2, "fn": 9 }, "high": { "tp": 524, "fp": 2, "fn": 228 }, "low": { "tp": 53, "fp": 0, "fn": 33 }, "medium": { "tp": 579, "fp": 2, "fn": 331 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 11.8, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 90.6769, "successful_runs": 66, "cost_per_run": 1.3739, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0678 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 979, "fp": 434, "fn": 923, "tn": 275, "precision": 0.6929, "recall": 0.5147, "f2_score": 54.3, "f3_score": 52.8, "cvss_precision": 0.7778, "cvss_recall": 0.5431, "cvss_f3_score": 56.0 }, "strict_micro": { "tp": 979, "fp": 434, "fn": 923, "tn": 275, "precision": 0.6929, "recall": 0.5147, "f2_score": 54.3, "f3_score": 52.8, "cvss_precision": 0.7778, "cvss_recall": 0.5431, "cvss_f3_score": 56.0 }, "macro": { "f2_score": 55.5 }, "per_severity": { "critical": { "tp": 139, "fp": 1, "fn": 15 }, "high": { "tp": 413, "fp": 1, "fn": 339 }, "low": { "tp": 32, "fp": 0, "fn": 54 }, "medium": { "tp": 395, "fp": 3, "fn": 515 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 13.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 34.3959, "successful_runs": 66, "cost_per_run": 0.5211, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0257 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 949, "fp": 275, "fn": 953, "tn": 272, "precision": 0.7753, "recall": 0.4989, "f2_score": 53.7, "f3_score": 51.7, "cvss_precision": 0.8319, "cvss_recall": 0.5271, "cvss_f3_score": 54.7 }, "strict_micro": { "tp": 949, "fp": 275, "fn": 953, "tn": 272, "precision": 0.7753, "recall": 0.4989, "f2_score": 53.7, "f3_score": 51.7, "cvss_precision": 0.8319, "cvss_recall": 0.5271, "cvss_f3_score": 54.7 }, "macro": { "f2_score": 55.9 }, "per_severity": { "critical": { "tp": 146, "fp": 0, "fn": 8 }, "high": { "tp": 385, "fp": 1, "fn": 367 }, "low": { "tp": 46, "fp": 2, "fn": 40 }, "medium": { "tp": 369, "fp": 3, "fn": 541 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 13.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 1.4988, "successful_runs": 114, "cost_per_run": 0.0131, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0009 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 918, "fp": 252, "fn": 983, "tn": 275, "precision": 0.7846, "recall": 0.4829, "f2_score": 52.3, "f3_score": 50.2, "cvss_precision": 0.8519, "cvss_recall": 0.5165, "cvss_f3_score": 53.8 }, "strict_micro": { "tp": 918, "fp": 252, "fn": 983, "tn": 275, "precision": 0.7846, "recall": 0.4829, "f2_score": 52.3, "f3_score": 50.2, "cvss_precision": 0.8519, "cvss_recall": 0.5165, "cvss_f3_score": 53.8 }, "macro": { "f2_score": 53.7 }, "per_severity": { "critical": { "tp": 139, "fp": 2, "fn": 15 }, "high": { "tp": 391, "fp": 1, "fn": 361 }, "low": { "tp": 40, "fp": 0, "fn": 46 }, "medium": { "tp": 351, "fp": 2, "fn": 559 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 9.5, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 11.2271, "successful_runs": 111, "cost_per_run": 0.1011, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0068 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 1126, "fp": 584, "fn": 776, "tn": 275, "precision": 0.6585, "recall": 0.592, "f2_score": 60.4, "f3_score": 59.8, "cvss_precision": 0.7138, "cvss_recall": 0.6163, "cvss_f3_score": 62.5 }, "strict_micro": { "tp": 1126, "fp": 584, "fn": 776, "tn": 275, "precision": 0.6585, "recall": 0.592, "f2_score": 60.4, "f3_score": 59.8, "cvss_precision": 0.7138, "cvss_recall": 0.6163, "cvss_f3_score": 62.5 }, "macro": { "f2_score": 61.3 }, "per_severity": { "critical": { "tp": 143, "fp": 0, "fn": 11 }, "high": { "tp": 468, "fp": 0, "fn": 284 }, "low": { "tp": 41, "fp": 0, "fn": 45 }, "medium": { "tp": 474, "fp": 5, "fn": 436 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 12.5, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 66, "cost_per_run": 0.0, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 614, "fp": 70, "fn": 1232, "tn": 269, "precision": 0.8977, "recall": 0.3326, "f2_score": 38.1, "f3_score": 35.5, "cvss_precision": 0.9146, "cvss_recall": 0.366, "cvss_f3_score": 38.9 }, "strict_micro": { "tp": 614, "fp": 70, "fn": 1289, "tn": 277, "precision": 0.8977, "recall": 0.3226, "f2_score": 37.0, "f3_score": 34.5, "cvss_precision": 0.9146, "cvss_recall": 0.355, "cvss_f3_score": 37.8 }, "macro": { "f2_score": 39.8 }, "per_severity": { "critical": { "tp": 125, "fp": 0, "fn": 23 }, "high": { "tp": 284, "fp": 2, "fn": 448 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 194, "fp": 1, "fn": 687 } }, "repos_scored": 64, "repos_total": 66, "f2_stddev": 11.7, "num_runs": 3, "language_coverage": { "python": [ 64, 66 ] }, "cost": { "total_cost": 81.0473, "successful_runs": 147, "cost_per_run": 0.5513, "total_loc_scanned": 131215, "cost_per_100_loc": 0.027 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 447, "fp": 49, "fn": 1455, "tn": 277, "precision": 0.9012, "recall": 0.235, "f2_score": 27.6, "f3_score": 25.4, "cvss_precision": 0.9468, "cvss_recall": 0.2695, "cvss_f3_score": 29.0 }, "strict_micro": { "tp": 447, "fp": 49, "fn": 1455, "tn": 277, "precision": 0.9012, "recall": 0.235, "f2_score": 27.6, "f3_score": 25.4, "cvss_precision": 0.9468, "cvss_recall": 0.2695, "cvss_f3_score": 29.0 }, "macro": { "f2_score": 29.2 }, "per_severity": { "critical": { "tp": 98, "fp": 1, "fn": 56 }, "high": { "tp": 219, "fp": 1, "fn": 533 }, "low": { "tp": 6, "fp": 0, "fn": 80 }, "medium": { "tp": 124, "fp": 1, "fn": 786 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 18.7, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 66, "cost_per_run": 0.0, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 620, "fp": 183, "fn": 1116, "tn": 249, "precision": 0.7721, "recall": 0.3571, "f2_score": 40.0, "f3_score": 37.7, "cvss_precision": 0.8206, "cvss_recall": 0.3859, "cvss_f3_score": 40.8 }, "strict_micro": { "tp": 620, "fp": 183, "fn": 1282, "tn": 278, "precision": 0.7721, "recall": 0.326, "f2_score": 36.9, "f3_score": 34.6, "cvss_precision": 0.8206, "cvss_recall": 0.3496, "cvss_f3_score": 37.1 }, "macro": { "f2_score": 41.0 }, "per_severity": { "critical": { "tp": 104, "fp": 1, "fn": 34 }, "high": { "tp": 268, "fp": 0, "fn": 428 }, "low": { "tp": 9, "fp": 0, "fn": 54 }, "medium": { "tp": 233, "fp": 1, "fn": 606 } }, "repos_scored": 62, "repos_total": 66, "f2_stddev": 21.9, "num_runs": 3, "language_coverage": { "python": [ 62, 66 ] }, "cost": { "total_cost": 13.8959, "successful_runs": 186, "cost_per_run": 0.0747, "total_loc_scanned": 129077, "cost_per_100_loc": 0.0036 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 854, "fp": 314, "fn": 1033, "tn": 272, "precision": 0.7312, "recall": 0.4526, "f2_score": 49.0, "f3_score": 47.0, "cvss_precision": 0.8011, "cvss_recall": 0.4798, "cvss_f3_score": 50.0 }, "strict_micro": { "tp": 854, "fp": 314, "fn": 1048, "tn": 276, "precision": 0.7312, "recall": 0.449, "f2_score": 48.7, "f3_score": 46.7, "cvss_precision": 0.8011, "cvss_recall": 0.4754, "cvss_f3_score": 49.6 }, "macro": { "f2_score": 49.6 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 25 }, "high": { "tp": 363, "fp": 3, "fn": 383 }, "low": { "tp": 36, "fp": 0, "fn": 48 }, "medium": { "tp": 335, "fp": 2, "fn": 569 } }, "repos_scored": 65, "repos_total": 66, "f2_stddev": 26.3, "num_runs": 3, "language_coverage": { "python": [ 65, 66 ] }, "cost": { "total_cost": 32.6591, "successful_runs": 195, "cost_per_run": 0.1675, "total_loc_scanned": 133330, "cost_per_100_loc": 0.0082 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 815, "fp": 454, "fn": 1087, "tn": 277, "precision": 0.6422, "recall": 0.4285, "f2_score": 45.9, "f3_score": 44.3, "cvss_precision": 0.7439, "cvss_recall": 0.4584, "cvss_f3_score": 47.7 }, "strict_micro": { "tp": 815, "fp": 454, "fn": 1087, "tn": 277, "precision": 0.6422, "recall": 0.4285, "f2_score": 45.9, "f3_score": 44.3, "cvss_precision": 0.7439, "cvss_recall": 0.4584, "cvss_f3_score": 47.7 }, "macro": { "f2_score": 46.1 }, "per_severity": { "critical": { "tp": 119, "fp": 2, "fn": 35 }, "high": { "tp": 353, "fp": 1, "fn": 399 }, "low": { "tp": 36, "fp": 0, "fn": 50 }, "medium": { "tp": 343, "fp": 1, "fn": 567 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 24.8, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 28.5574, "successful_runs": 197, "cost_per_run": 0.145, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0072 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 1213, "fp": 820, "fn": 689, "tn": 272, "precision": 0.5967, "recall": 0.6377, "f2_score": 62.9, "f3_score": 63.3, "cvss_precision": 0.678, "cvss_recall": 0.663, "cvss_f3_score": 66.4 }, "strict_micro": { "tp": 1213, "fp": 820, "fn": 689, "tn": 272, "precision": 0.5967, "recall": 0.6377, "f2_score": 62.9, "f3_score": 63.3, "cvss_precision": 0.678, "cvss_recall": 0.663, "cvss_f3_score": 66.4 }, "macro": { "f2_score": 64.0 }, "per_severity": { "critical": { "tp": 146, "fp": 2, "fn": 8 }, "high": { "tp": 508, "fp": 0, "fn": 244 }, "low": { "tp": 48, "fp": 0, "fn": 38 }, "medium": { "tp": 511, "fp": 6, "fn": 399 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 11.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 34.1092, "successful_runs": 66, "cost_per_run": 0.5168, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0255 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 1053, "fp": 397, "fn": 849, "tn": 280, "precision": 0.7262, "recall": 0.5536, "f2_score": 58.1, "f3_score": 56.7, "cvss_precision": 0.8156, "cvss_recall": 0.5951, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 1053, "fp": 397, "fn": 849, "tn": 280, "precision": 0.7262, "recall": 0.5536, "f2_score": 58.1, "f3_score": 56.7, "cvss_precision": 0.8156, "cvss_recall": 0.5951, "cvss_f3_score": 61.2 }, "macro": { "f2_score": 59.7 }, "per_severity": { "critical": { "tp": 146, "fp": 1, "fn": 8 }, "high": { "tp": 455, "fp": 0, "fn": 297 }, "low": { "tp": 41, "fp": 0, "fn": 45 }, "medium": { "tp": 412, "fp": 1, "fn": 498 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 12.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 144.1409, "successful_runs": 196, "cost_per_run": 0.7354, "total_loc_scanned": 133782, "cost_per_100_loc": 0.036 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 760, "fp": 168, "fn": 1142, "tn": 278, "precision": 0.819, "recall": 0.3996, "f2_score": 44.5, "f3_score": 42.1, "cvss_precision": 0.8825, "cvss_recall": 0.4339, "cvss_f3_score": 45.7 }, "strict_micro": { "tp": 760, "fp": 168, "fn": 1142, "tn": 278, "precision": 0.819, "recall": 0.3996, "f2_score": 44.5, "f3_score": 42.1, "cvss_precision": 0.8825, "cvss_recall": 0.4339, "cvss_f3_score": 45.7 }, "macro": { "f2_score": 46.7 }, "per_severity": { "critical": { "tp": 128, "fp": 0, "fn": 26 }, "high": { "tp": 334, "fp": 0, "fn": 418 }, "low": { "tp": 15, "fp": 0, "fn": 71 }, "medium": { "tp": 283, "fp": 2, "fn": 627 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 1.0844, "successful_runs": 66, "cost_per_run": 0.0164, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0008 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 1497, "fp": 624, "fn": 405, "tn": 277, "precision": 0.7058, "recall": 0.7871, "f2_score": 76.9, "f3_score": 77.8, "cvss_precision": 0.7525, "cvss_recall": 0.7975, "cvss_f3_score": 79.3 }, "strict_micro": { "tp": 1497, "fp": 624, "fn": 405, "tn": 277, "precision": 0.7058, "recall": 0.7871, "f2_score": 76.9, "f3_score": 77.8, "cvss_precision": 0.7525, "cvss_recall": 0.7975, "cvss_f3_score": 79.3 }, "macro": { "f2_score": 77.7 }, "per_severity": { "critical": { "tp": 142, "fp": 0, "fn": 12 }, "high": { "tp": 610, "fp": 1, "fn": 142 }, "low": { "tp": 45, "fp": 0, "fn": 41 }, "medium": { "tp": 700, "fp": 2, "fn": 210 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 19.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 181.0324, "successful_runs": 66, "cost_per_run": 2.7429, "total_loc_scanned": 133782, "cost_per_100_loc": 0.1353 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 886, "fp": 273, "fn": 1016, "tn": 279, "precision": 0.7645, "recall": 0.4658, "f2_score": 50.5, "f3_score": 48.5, "cvss_precision": 0.8262, "cvss_recall": 0.5087, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 886, "fp": 273, "fn": 1016, "tn": 279, "precision": 0.7645, "recall": 0.4658, "f2_score": 50.5, "f3_score": 48.5, "cvss_precision": 0.8262, "cvss_recall": 0.5087, "cvss_f3_score": 52.9 }, "macro": { "f2_score": 53.1 }, "per_severity": { "critical": { "tp": 137, "fp": 0, "fn": 17 }, "high": { "tp": 406, "fp": 0, "fn": 346 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 315, "fp": 1, "fn": 595 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 15.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 29.62, "successful_runs": 66, "cost_per_run": 0.4488, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0221 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 925, "fp": 692, "fn": 977, "tn": 276, "precision": 0.572, "recall": 0.4863, "f2_score": 50.1, "f3_score": 49.4, "cvss_precision": 0.6442, "cvss_recall": 0.5328, "cvss_f3_score": 54.2 }, "strict_micro": { "tp": 925, "fp": 692, "fn": 977, "tn": 276, "precision": 0.572, "recall": 0.4863, "f2_score": 50.1, "f3_score": 49.4, "cvss_precision": 0.6442, "cvss_recall": 0.5328, "cvss_f3_score": 54.2 }, "macro": { "f2_score": 51.6 }, "per_severity": { "critical": { "tp": 133, "fp": 0, "fn": 21 }, "high": { "tp": 421, "fp": 1, "fn": 331 }, "low": { "tp": 34, "fp": 0, "fn": 52 }, "medium": { "tp": 337, "fp": 3, "fn": 573 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 14.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 279.2054, "successful_runs": 66, "cost_per_run": 4.2304, "total_loc_scanned": 133782, "cost_per_100_loc": 0.2087 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 1532, "fp": 511, "fn": 370, "tn": 278, "precision": 0.7499, "recall": 0.8055, "f2_score": 79.4, "f3_score": 80.0, "cvss_precision": 0.791, "cvss_recall": 0.8092, "cvss_f3_score": 80.7 }, "strict_micro": { "tp": 1532, "fp": 511, "fn": 370, "tn": 278, "precision": 0.7499, "recall": 0.8055, "f2_score": 79.4, "f3_score": 80.0, "cvss_precision": 0.791, "cvss_recall": 0.8092, "cvss_f3_score": 80.7 }, "macro": { "f2_score": 80.9 }, "per_severity": { "critical": { "tp": 141, "fp": 0, "fn": 13 }, "high": { "tp": 618, "fp": 0, "fn": 134 }, "low": { "tp": 44, "fp": 0, "fn": 42 }, "medium": { "tp": 729, "fp": 2, "fn": 181 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 19.1, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 178.4459, "successful_runs": 66, "cost_per_run": 2.7037, "total_loc_scanned": 133782, "cost_per_100_loc": 0.1334 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 842, "fp": 322, "fn": 1059, "tn": 269, "precision": 0.7234, "recall": 0.4429, "f2_score": 48.0, "f3_score": 46.1, "cvss_precision": 0.7945, "cvss_recall": 0.471, "cvss_f3_score": 49.1 }, "strict_micro": { "tp": 842, "fp": 322, "fn": 1059, "tn": 269, "precision": 0.7234, "recall": 0.4429, "f2_score": 48.0, "f3_score": 46.1, "cvss_precision": 0.7945, "cvss_recall": 0.471, "cvss_f3_score": 49.1 }, "macro": { "f2_score": 49.1 }, "per_severity": { "critical": { "tp": 136, "fp": 1, "fn": 18 }, "high": { "tp": 336, "fp": 7, "fn": 416 }, "low": { "tp": 31, "fp": 0, "fn": 55 }, "medium": { "tp": 325, "fp": 2, "fn": 585 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 10.3, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 7.9565, "successful_runs": 192, "cost_per_run": 0.0414, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0021 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 908, "fp": 312, "fn": 995, "tn": 277, "precision": 0.7443, "recall": 0.4771, "f2_score": 51.4, "f3_score": 49.5, "cvss_precision": 0.8333, "cvss_recall": 0.5123, "cvss_f3_score": 53.3 }, "strict_micro": { "tp": 908, "fp": 312, "fn": 995, "tn": 277, "precision": 0.7443, "recall": 0.4771, "f2_score": 51.4, "f3_score": 49.5, "cvss_precision": 0.8333, "cvss_recall": 0.5123, "cvss_f3_score": 53.3 }, "macro": { "f2_score": 52.5 }, "per_severity": { "critical": { "tp": 129, "fp": 1, "fn": 25 }, "high": { "tp": 365, "fp": 3, "fn": 387 }, "low": { "tp": 28, "fp": 0, "fn": 58 }, "medium": { "tp": 338, "fp": 1, "fn": 572 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 14.1, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 21.0418, "successful_runs": 157, "cost_per_run": 0.134, "total_loc_scanned": 133329, "cost_per_100_loc": 0.0064 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 965, "fp": 464, "fn": 936, "tn": 276, "precision": 0.6753, "recall": 0.5076, "f2_score": 53.4, "f3_score": 52.1, "cvss_precision": 0.7922, "cvss_recall": 0.5467, "cvss_f3_score": 56.4 }, "strict_micro": { "tp": 965, "fp": 464, "fn": 936, "tn": 276, "precision": 0.6753, "recall": 0.5076, "f2_score": 53.4, "f3_score": 52.1, "cvss_precision": 0.7922, "cvss_recall": 0.5467, "cvss_f3_score": 56.4 }, "macro": { "f2_score": 55.0 }, "per_severity": { "critical": { "tp": 139, "fp": 1, "fn": 15 }, "high": { "tp": 419, "fp": 1, "fn": 333 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 391, "fp": 4, "fn": 519 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 10.0, "num_runs": 3, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 25.5527, "successful_runs": 187, "cost_per_run": 0.1366, "total_loc_scanned": 133782, "cost_per_100_loc": 0.007 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 1107, "fp": 409, "fn": 795, "tn": 277, "precision": 0.7302, "recall": 0.582, "f2_score": 60.7, "f3_score": 59.4, "cvss_precision": 0.8323, "cvss_recall": 0.6077, "cvss_f3_score": 62.5 }, "strict_micro": { "tp": 1107, "fp": 409, "fn": 795, "tn": 277, "precision": 0.7302, "recall": 0.582, "f2_score": 60.7, "f3_score": 59.4, "cvss_precision": 0.8323, "cvss_recall": 0.6077, "cvss_f3_score": 62.5 }, "macro": { "f2_score": 62.3 }, "per_severity": { "critical": { "tp": 142, "fp": 0, "fn": 12 }, "high": { "tp": 468, "fp": 2, "fn": 284 }, "low": { "tp": 46, "fp": 0, "fn": 40 }, "medium": { "tp": 451, "fp": 1, "fn": 459 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 21.3334, "successful_runs": 66, "cost_per_run": 0.3232, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0159 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 883, "fp": 437, "fn": 1019, "tn": 262, "precision": 0.6689, "recall": 0.4642, "f2_score": 49.5, "f3_score": 47.9, "cvss_precision": 0.6852, "cvss_recall": 0.4946, "cvss_f3_score": 50.9 }, "strict_micro": { "tp": 883, "fp": 437, "fn": 1019, "tn": 262, "precision": 0.6689, "recall": 0.4642, "f2_score": 49.5, "f3_score": 47.9, "cvss_precision": 0.6852, "cvss_recall": 0.4946, "cvss_f3_score": 50.9 }, "macro": { "f2_score": 51.4 }, "per_severity": { "critical": { "tp": 128, "fp": 1, "fn": 26 }, "high": { "tp": 398, "fp": 3, "fn": 354 }, "low": { "tp": 23, "fp": 0, "fn": 63 }, "medium": { "tp": 334, "fp": 14, "fn": 576 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 16.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 290.6804, "successful_runs": 66, "cost_per_run": 4.4042, "total_loc_scanned": 133782, "cost_per_100_loc": 0.2173 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 1466, "fp": 3126, "fn": 436, "tn": 261, "precision": 0.3193, "recall": 0.7708, "f2_score": 60.1, "f3_score": 67.5, "cvss_precision": 0.3021, "cvss_recall": 0.7825, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 1466, "fp": 3126, "fn": 436, "tn": 261, "precision": 0.3193, "recall": 0.7708, "f2_score": 60.1, "f3_score": 67.5, "cvss_precision": 0.3021, "cvss_recall": 0.7825, "cvss_f3_score": 67.5 }, "macro": { "f2_score": 60.5 }, "per_severity": { "critical": { "tp": 139, "fp": 2, "fn": 15 }, "high": { "tp": 576, "fp": 8, "fn": 176 }, "low": { "tp": 58, "fp": 1, "fn": 28 }, "medium": { "tp": 693, "fp": 8, "fn": 217 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 9.0, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 146.0, "successful_runs": 66, "cost_per_run": 2.2121, "total_loc_scanned": 133782, "cost_per_100_loc": 0.1091 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 1310, "fp": 1668, "fn": 592, "tn": 267, "precision": 0.4399, "recall": 0.6887, "f2_score": 61.9, "f3_score": 65.2, "cvss_precision": 0.4195, "cvss_recall": 0.7062, "cvss_f3_score": 66.1 }, "strict_micro": { "tp": 1310, "fp": 1668, "fn": 592, "tn": 267, "precision": 0.4399, "recall": 0.6887, "f2_score": 61.9, "f3_score": 65.2, "cvss_precision": 0.4195, "cvss_recall": 0.7062, "cvss_f3_score": 66.1 }, "macro": { "f2_score": 63.0 }, "per_severity": { "critical": { "tp": 138, "fp": 0, "fn": 16 }, "high": { "tp": 529, "fp": 7, "fn": 223 }, "low": { "tp": 45, "fp": 1, "fn": 41 }, "medium": { "tp": 598, "fp": 5, "fn": 312 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 10.9, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 22.25, "successful_runs": 66, "cost_per_run": 0.3371, "total_loc_scanned": 133782, "cost_per_100_loc": 0.0166 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 235, "fp": 120, "fn": 1667, "tn": 279, "precision": 0.662, "recall": 0.1236, "f2_score": 14.8, "f3_score": 13.4, "cvss_precision": 0.643, "cvss_recall": 0.1444, "cvss_f3_score": 15.6 }, "strict_micro": { "tp": 235, "fp": 120, "fn": 1667, "tn": 279, "precision": 0.662, "recall": 0.1236, "f2_score": 14.8, "f3_score": 13.4, "cvss_precision": 0.643, "cvss_recall": 0.1444, "cvss_f3_score": 15.6 }, "macro": { "f2_score": 16.3 }, "per_severity": { "critical": { "tp": 36, "fp": 0, "fn": 118 }, "high": { "tp": 129, "fp": 1, "fn": 623 }, "low": { "tp": 4, "fp": 0, "fn": 82 }, "medium": { "tp": 66, "fp": 0, "fn": 844 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 1525, "fp": 3180, "fn": 377, "tn": 247, "precision": 0.3241, "recall": 0.8018, "f2_score": 61.9, "f3_score": 69.9, "cvss_precision": 0.2963, "cvss_recall": 0.8146, "cvss_f3_score": 69.3 }, "strict_micro": { "tp": 1525, "fp": 3180, "fn": 377, "tn": 247, "precision": 0.3241, "recall": 0.8018, "f2_score": 61.9, "f3_score": 69.9, "cvss_precision": 0.2963, "cvss_recall": 0.8146, "cvss_f3_score": 69.3 }, "macro": { "f2_score": 62.9 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 608, "fp": 10, "fn": 144 }, "low": { "tp": 64, "fp": 2, "fn": 22 }, "medium": { "tp": 702, "fp": 16, "fn": 208 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 8.5, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 1688, "fp": 721, "fn": 214, "tn": 270, "precision": 0.7007, "recall": 0.8875, "f2_score": 84.3, "f3_score": 86.4, "cvss_precision": 0.6571, "cvss_recall": 0.8896, "cvss_f3_score": 85.9 }, "strict_micro": { "tp": 1688, "fp": 721, "fn": 214, "tn": 270, "precision": 0.7007, "recall": 0.8875, "f2_score": 84.3, "f3_score": 86.4, "cvss_precision": 0.6571, "cvss_recall": 0.8896, "cvss_f3_score": 85.9 }, "macro": { "f2_score": 84.4 }, "per_severity": { "critical": { "tp": 143, "fp": 1, "fn": 11 }, "high": { "tp": 661, "fp": 4, "fn": 91 }, "low": { "tp": 79, "fp": 0, "fn": 7 }, "medium": { "tp": 805, "fp": 5, "fn": 105 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 6.3, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 986, "fp": 1115, "fn": 916, "tn": 277, "precision": 0.4693, "recall": 0.5184, "f2_score": 50.8, "f3_score": 51.3, "cvss_precision": 0.4737, "cvss_recall": 0.5437, "cvss_f3_score": 53.6 }, "strict_micro": { "tp": 986, "fp": 1115, "fn": 916, "tn": 277, "precision": 0.4693, "recall": 0.5184, "f2_score": 50.8, "f3_score": 51.3, "cvss_precision": 0.4737, "cvss_recall": 0.5437, "cvss_f3_score": 53.6 }, "macro": { "f2_score": 52.0 }, "per_severity": { "critical": { "tp": 119, "fp": 0, "fn": 35 }, "high": { "tp": 407, "fp": 2, "fn": 345 }, "low": { "tp": 33, "fp": 0, "fn": 53 }, "medium": { "tp": 427, "fp": 1, "fn": 483 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 15.6, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 1549, "fp": 4289, "fn": 353, "tn": 247, "precision": 0.2653, "recall": 0.8144, "f2_score": 57.6, "f3_score": 67.5, "cvss_precision": 0.2485, "cvss_recall": 0.8265, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 1549, "fp": 4289, "fn": 353, "tn": 247, "precision": 0.2653, "recall": 0.8144, "f2_score": 57.6, "f3_score": 67.5, "cvss_precision": 0.2485, "cvss_recall": 0.8265, "cvss_f3_score": 67.1 }, "macro": { "f2_score": 58.8 }, "per_severity": { "critical": { "tp": 151, "fp": 5, "fn": 3 }, "high": { "tp": 613, "fp": 10, "fn": 139 }, "low": { "tp": 68, "fp": 2, "fn": 18 }, "medium": { "tp": 717, "fp": 16, "fn": 193 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 9.2, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 532, "fp": 294, "fn": 1227, "tn": 248, "precision": 0.6441, "recall": 0.3024, "f2_score": 33.8, "f3_score": 31.9, "cvss_precision": 0.7156, "cvss_recall": 0.3409, "cvss_f3_score": 36.0 }, "strict_micro": { "tp": 532, "fp": 294, "fn": 1371, "tn": 268, "precision": 0.6441, "recall": 0.2796, "f2_score": 31.5, "f3_score": 29.6, "cvss_precision": 0.7156, "cvss_recall": 0.3164, "cvss_f3_score": 33.5 }, "macro": { "f2_score": 35.4 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 44 }, "high": { "tp": 239, "fp": 7, "fn": 453 }, "low": { "tp": 13, "fp": 0, "fn": 69 }, "medium": { "tp": 164, "fp": 10, "fn": 674 } }, "repos_scored": 61, "repos_total": 66, "f2_stddev": 16.2, "num_runs": 3, "language_coverage": { "python": [ 61, 66 ] }, "cost": { "total_cost": 7.523, "successful_runs": 136, "cost_per_run": 0.0553, "total_loc_scanned": 116141, "cost_per_100_loc": 0.0032 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 417, "fp": 363, "fn": 1241, "tn": 232, "precision": 0.5346, "recall": 0.2515, "f2_score": 28.1, "f3_score": 26.6, "cvss_precision": 0.613, "cvss_recall": 0.2758, "cvss_f3_score": 29.2 }, "strict_micro": { "tp": 417, "fp": 363, "fn": 1485, "tn": 266, "precision": 0.5346, "recall": 0.2192, "f2_score": 24.9, "f3_score": 23.3, "cvss_precision": 0.613, "cvss_recall": 0.2405, "cvss_f3_score": 25.6 }, "macro": { "f2_score": 28.1 }, "per_severity": { "critical": { "tp": 70, "fp": 1, "fn": 69 }, "high": { "tp": 179, "fp": 6, "fn": 479 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 156, "fp": 7, "fn": 637 } }, "repos_scored": 58, "repos_total": 66, "f2_stddev": 24.8, "num_runs": 1, "language_coverage": { "python": [ 58, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 58, "cost_per_run": 0.0, "total_loc_scanned": 117112, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 674, "fp": 437, "fn": 1192, "tn": 260, "precision": 0.6067, "recall": 0.3612, "f2_score": 39.3, "f3_score": 37.6, "cvss_precision": 0.7016, "cvss_recall": 0.3906, "cvss_f3_score": 40.9 }, "strict_micro": { "tp": 674, "fp": 437, "fn": 1228, "tn": 264, "precision": 0.6067, "recall": 0.3544, "f2_score": 38.7, "f3_score": 37.0, "cvss_precision": 0.7016, "cvss_recall": 0.3824, "cvss_f3_score": 40.1 }, "macro": { "f2_score": 42.3 }, "per_severity": { "critical": { "tp": 102, "fp": 1, "fn": 48 }, "high": { "tp": 292, "fp": 8, "fn": 446 }, "low": { "tp": 21, "fp": 1, "fn": 64 }, "medium": { "tp": 259, "fp": 6, "fn": 634 } }, "repos_scored": 65, "repos_total": 66, "f2_stddev": 21.4, "num_runs": 1, "language_coverage": { "python": [ 65, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 65, "cost_per_run": 0.0, "total_loc_scanned": 131775, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 445, "fp": 1737, "fn": 1422, "tn": 247, "precision": 0.2039, "recall": 0.2384, "f2_score": 23.1, "f3_score": 23.4, "cvss_precision": 0.3196, "cvss_recall": 0.2624, "cvss_f3_score": 26.7 }, "strict_micro": { "tp": 445, "fp": 1737, "fn": 1457, "tn": 254, "precision": 0.2039, "recall": 0.234, "f2_score": 22.7, "f3_score": 23.1, "cvss_precision": 0.3196, "cvss_recall": 0.2566, "cvss_f3_score": 26.2 }, "macro": { "f2_score": 23.5 }, "per_severity": { "critical": { "tp": 118, "fp": 2, "fn": 31 }, "high": { "tp": 145, "fp": 20, "fn": 593 }, "low": { "tp": 6, "fp": 0, "fn": 78 }, "medium": { "tp": 176, "fp": 4, "fn": 720 } }, "repos_scored": 64, "repos_total": 66, "f2_stddev": 9.1, "num_runs": 1, "language_coverage": { "python": [ 64, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 134, "fp": 905, "fn": 1768, "tn": 275, "precision": 0.129, "recall": 0.0705, "f2_score": 7.7, "f3_score": 7.4, "cvss_precision": 0.1656, "cvss_recall": 0.0838, "cvss_f3_score": 8.8 }, "strict_micro": { "tp": 134, "fp": 905, "fn": 1768, "tn": 275, "precision": 0.129, "recall": 0.0705, "f2_score": 7.7, "f3_score": 7.4, "cvss_precision": 0.1656, "cvss_recall": 0.0838, "cvss_f3_score": 8.8 }, "macro": { "f2_score": 7.7 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 113 }, "high": { "tp": 44, "fp": 4, "fn": 708 }, "low": { "tp": 3, "fp": 0, "fn": 83 }, "medium": { "tp": 46, "fp": 1, "fn": 864 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 274, "fp": 1587, "fn": 1628, "tn": 279, "precision": 0.1472, "recall": 0.1441, "f2_score": 14.5, "f3_score": 14.4, "cvss_precision": 0.1601, "cvss_recall": 0.1439, "cvss_f3_score": 14.5 }, "strict_micro": { "tp": 274, "fp": 1587, "fn": 1628, "tn": 279, "precision": 0.1472, "recall": 0.1441, "f2_score": 14.5, "f3_score": 14.4, "cvss_precision": 0.1601, "cvss_recall": 0.1439, "cvss_f3_score": 14.5 }, "macro": { "f2_score": 13.6 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 113 }, "high": { "tp": 91, "fp": 0, "fn": 661 }, "low": { "tp": 0, "fp": 0, "fn": 86 }, "medium": { "tp": 142, "fp": 1, "fn": 768 } }, "repos_scored": 66, "repos_total": 66, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 66, 66 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "tsjs": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 779, "fp": 1147, "fn": 1457, "tn": 0, "precision": 0.4045, "recall": 0.3484, "f2_score": 35.8, "f3_score": 35.3, "cvss_precision": 0.4387, "cvss_recall": 0.3717, "cvss_f3_score": 37.7 }, "strict_micro": { "tp": 779, "fp": 1147, "fn": 1457, "tn": 0, "precision": 0.4045, "recall": 0.3484, "f2_score": 35.8, "f3_score": 35.3, "cvss_precision": 0.4387, "cvss_recall": 0.3717, "cvss_f3_score": 37.7 }, "macro": { "f2_score": 36.4 }, "per_severity": { "high": { "tp": 768, "fp": 0, "fn": 1328 }, "medium": { "tp": 8, "fp": 0, "fn": 48 }, "low": { "tp": 2, "fp": 0, "fn": 78 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 96.2721, "successful_runs": 74, "cost_per_run": 1.301, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0159 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 734, "fp": 1031, "fn": 1502, "tn": 0, "precision": 0.4159, "recall": 0.3283, "f2_score": 34.3, "f3_score": 33.5, "cvss_precision": 0.4647, "cvss_recall": 0.3538, "cvss_f3_score": 36.2 }, "strict_micro": { "tp": 734, "fp": 1031, "fn": 1502, "tn": 0, "precision": 0.4159, "recall": 0.3283, "f2_score": 34.3, "f3_score": 33.5, "cvss_precision": 0.4647, "cvss_recall": 0.3538, "cvss_f3_score": 36.2 }, "macro": { "f2_score": 36.2 }, "per_severity": { "high": { "tp": 720, "fp": 0, "fn": 1376 }, "medium": { "tp": 10, "fp": 0, "fn": 46 }, "low": { "tp": 3, "fp": 0, "fn": 77 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 16.7, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 2.3347, "successful_runs": 74, "cost_per_run": 0.0316, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0004 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 589, "fp": 715, "fn": 1647, "tn": 0, "precision": 0.4517, "recall": 0.2634, "f2_score": 28.7, "f3_score": 27.5, "cvss_precision": 0.5065, "cvss_recall": 0.2824, "cvss_f3_score": 29.6 }, "strict_micro": { "tp": 589, "fp": 715, "fn": 1647, "tn": 0, "precision": 0.4517, "recall": 0.2634, "f2_score": 28.7, "f3_score": 27.5, "cvss_precision": 0.5065, "cvss_recall": 0.2824, "cvss_f3_score": 29.6 }, "macro": { "f2_score": 29.2 }, "per_severity": { "high": { "tp": 577, "fp": 0, "fn": 1519 }, "medium": { "tp": 8, "fp": 0, "fn": 48 }, "low": { "tp": 3, "fp": 0, "fn": 77 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 21.0, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 3.8504, "successful_runs": 74, "cost_per_run": 0.052, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0006 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 973, "fp": 1327, "fn": 1263, "tn": 0, "precision": 0.423, "recall": 0.4352, "f2_score": 43.3, "f3_score": 43.4, "cvss_precision": 0.4428, "cvss_recall": 0.4504, "cvss_f3_score": 45.0 }, "strict_micro": { "tp": 973, "fp": 1327, "fn": 1263, "tn": 0, "precision": 0.423, "recall": 0.4352, "f2_score": 43.3, "f3_score": 43.4, "cvss_precision": 0.4428, "cvss_recall": 0.4504, "cvss_f3_score": 45.0 }, "macro": { "f2_score": 44.1 }, "per_severity": { "high": { "tp": 962, "fp": 0, "fn": 1134 }, "medium": { "tp": 7, "fp": 0, "fn": 49 }, "low": { "tp": 4, "fp": 0, "fn": 76 }, "critical": { "tp": 0, "fp": 0, "fn": 4 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 16.9, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 74, "cost_per_run": 0.0, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 1102, "fp": 2022, "fn": 940, "tn": 0, "precision": 0.3528, "recall": 0.5397, "f2_score": 48.8, "f3_score": 51.3, "cvss_precision": 0.3847, "cvss_recall": 0.5577, "cvss_f3_score": 53.4 }, "strict_micro": { "tp": 1102, "fp": 2022, "fn": 1134, "tn": 0, "precision": 0.3528, "recall": 0.4928, "f2_score": 45.7, "f3_score": 47.4, "cvss_precision": 0.3847, "cvss_recall": 0.5099, "cvss_f3_score": 49.4 }, "macro": { "f2_score": 48.9 }, "per_severity": { "high": { "tp": 1073, "fp": 0, "fn": 857 }, "medium": { "tp": 20, "fp": 0, "fn": 32 }, "low": { "tp": 9, "fp": 0, "fn": 49 }, "critical": { "tp": 0, "fp": 0, "fn": 2 } }, "repos_scored": 70, "repos_total": 74, "f2_stddev": 13.4, "num_runs": 1, "language_coverage": { "tsjs": [ 70, 74 ] }, "cost": { "total_cost": 71.6217, "successful_runs": 70, "cost_per_run": 1.0232, "total_loc_scanned": 579947, "cost_per_100_loc": 0.0123 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 1686, "fp": 1558, "fn": 550, "tn": 0, "precision": 0.5197, "recall": 0.754, "f2_score": 69.2, "f3_score": 72.1, "cvss_precision": 0.5295, "cvss_recall": 0.7582, "cvss_f3_score": 72.7 }, "strict_micro": { "tp": 1686, "fp": 1558, "fn": 550, "tn": 0, "precision": 0.5197, "recall": 0.754, "f2_score": 69.2, "f3_score": 72.1, "cvss_precision": 0.5295, "cvss_recall": 0.7582, "cvss_f3_score": 72.7 }, "macro": { "f2_score": 68.3 }, "per_severity": { "high": { "tp": 1586, "fp": 0, "fn": 510 }, "medium": { "tp": 37, "fp": 0, "fn": 19 }, "low": { "tp": 60, "fp": 0, "fn": 20 }, "critical": { "tp": 3, "fp": 0, "fn": 1 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 21.9, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 379.3045, "successful_runs": 74, "cost_per_run": 5.1257, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0625 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 1272, "fp": 2023, "fn": 964, "tn": 0, "precision": 0.386, "recall": 0.5689, "f2_score": 52.0, "f3_score": 54.3, "cvss_precision": 0.3989, "cvss_recall": 0.5856, "cvss_f3_score": 55.9 }, "strict_micro": { "tp": 1272, "fp": 2023, "fn": 964, "tn": 0, "precision": 0.386, "recall": 0.5689, "f2_score": 52.0, "f3_score": 54.3, "cvss_precision": 0.3989, "cvss_recall": 0.5856, "cvss_f3_score": 55.9 }, "macro": { "f2_score": 52.4 }, "per_severity": { "high": { "tp": 1233, "fp": 0, "fn": 863 }, "medium": { "tp": 30, "fp": 0, "fn": 26 }, "low": { "tp": 7, "fp": 0, "fn": 73 }, "critical": { "tp": 2, "fp": 0, "fn": 2 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 13.7, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 761.4097, "successful_runs": 74, "cost_per_run": 10.2893, "total_loc_scanned": 607252, "cost_per_100_loc": 0.1254 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 1851, "fp": 1394, "fn": 385, "tn": 0, "precision": 0.5704, "recall": 0.8278, "f2_score": 75.9, "f3_score": 79.2, "cvss_precision": 0.5796, "cvss_recall": 0.828, "cvss_f3_score": 79.4 }, "strict_micro": { "tp": 1851, "fp": 1394, "fn": 385, "tn": 0, "precision": 0.5704, "recall": 0.8278, "f2_score": 75.9, "f3_score": 79.2, "cvss_precision": 0.5796, "cvss_recall": 0.828, "cvss_f3_score": 79.4 }, "macro": { "f2_score": 74.5 }, "per_severity": { "high": { "tp": 1732, "fp": 0, "fn": 364 }, "medium": { "tp": 47, "fp": 0, "fn": 9 }, "low": { "tp": 69, "fp": 0, "fn": 11 }, "critical": { "tp": 3, "fp": 0, "fn": 1 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 19.2, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 369.1152, "successful_runs": 74, "cost_per_run": 4.988, "total_loc_scanned": 607252, "cost_per_100_loc": 0.0608 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 2045, "fp": 2556, "fn": 191, "tn": 0, "precision": 0.4445, "recall": 0.9146, "f2_score": 75.5, "f3_score": 82.7, "cvss_precision": 0.4036, "cvss_recall": 0.9135, "cvss_f3_score": 81.1 }, "strict_micro": { "tp": 2045, "fp": 2556, "fn": 191, "tn": 0, "precision": 0.4445, "recall": 0.9146, "f2_score": 75.5, "f3_score": 82.7, "cvss_precision": 0.4036, "cvss_recall": 0.9135, "cvss_f3_score": 81.1 }, "macro": { "f2_score": 74.6 }, "per_severity": { "high": { "tp": 1925, "fp": 0, "fn": 171 }, "medium": { "tp": 51, "fp": 0, "fn": 5 }, "low": { "tp": 67, "fp": 0, "fn": 13 }, "critical": { "tp": 2, "fp": 0, "fn": 2 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 10.5, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 276, "fp": 2240, "fn": 1960, "tn": 0, "precision": 0.1097, "recall": 0.1234, "f2_score": 12.0, "f3_score": 12.2, "cvss_precision": 0.1292, "cvss_recall": 0.1395, "cvss_f3_score": 13.8 }, "strict_micro": { "tp": 276, "fp": 2240, "fn": 1960, "tn": 0, "precision": 0.1097, "recall": 0.1234, "f2_score": 12.0, "f3_score": 12.2, "cvss_precision": 0.1292, "cvss_recall": 0.1395, "cvss_f3_score": 13.8 }, "macro": { "f2_score": 11.8 }, "per_severity": { "high": { "tp": 274, "fp": 0, "fn": 1822 }, "medium": { "tp": 2, "fp": 0, "fn": 54 }, "low": { "tp": 0, "fp": 0, "fn": 80 }, "critical": { "tp": 0, "fp": 0, "fn": 4 } }, "repos_scored": 74, "repos_total": 74, "f2_stddev": 9.5, "num_runs": 1, "language_coverage": { "tsjs": [ 74, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 2236, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 74, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 74 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "intentional": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 487, "fp": 331, "fn": 216, "tn": 117, "precision": 0.5954, "recall": 0.6927, "f2_score": 67.1, "f3_score": 68.2, "cvss_precision": 0.6605, "cvss_recall": 0.7246, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 487, "fp": 331, "fn": 751, "tn": 117, "precision": 0.5954, "recall": 0.3934, "f2_score": 42.2, "f3_score": 40.7, "cvss_precision": 0.6605, "cvss_recall": 0.415, "cvss_f3_score": 43.1 }, "macro": { "f2_score": 70.5 }, "per_severity": { "critical": { "tp": 80, "fp": 2, "fn": 7 }, "high": { "tp": 187, "fp": 1, "fn": 78 }, "low": { "tp": 35, "fp": 0, "fn": 33 }, "medium": { "tp": 185, "fp": 1, "fn": 98 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 24.5673, "successful_runs": 26, "cost_per_run": 0.9449, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1225 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 516, "fp": 462, "fn": 722, "tn": 118, "precision": 0.5276, "recall": 0.4168, "f2_score": 43.5, "f3_score": 42.6, "cvss_precision": 0.5892, "cvss_recall": 0.4553, "cvss_f3_score": 46.6 }, "strict_micro": { "tp": 516, "fp": 462, "fn": 722, "tn": 118, "precision": 0.5276, "recall": 0.4168, "f2_score": 43.5, "f3_score": 42.6, "cvss_precision": 0.5892, "cvss_recall": 0.4553, "cvss_f3_score": 46.6 }, "macro": { "f2_score": 46.9 }, "per_severity": { "critical": { "tp": 74, "fp": 1, "fn": 13 }, "high": { "tp": 315, "fp": 1, "fn": 401 }, "low": { "tp": 16, "fp": 0, "fn": 121 }, "medium": { "tp": 111, "fp": 1, "fn": 187 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.8, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 22.6018, "successful_runs": 50, "cost_per_run": 0.452, "total_loc_scanned": 154731, "cost_per_100_loc": 0.0146 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 539, "fp": 406, "fn": 699, "tn": 118, "precision": 0.5704, "recall": 0.4354, "f2_score": 45.7, "f3_score": 44.6, "cvss_precision": 0.6291, "cvss_recall": 0.4668, "cvss_f3_score": 47.9 }, "strict_micro": { "tp": 539, "fp": 406, "fn": 699, "tn": 118, "precision": 0.5704, "recall": 0.4354, "f2_score": 45.7, "f3_score": 44.6, "cvss_precision": 0.6291, "cvss_recall": 0.4668, "cvss_f3_score": 47.9 }, "macro": { "f2_score": 51.0 }, "per_severity": { "critical": { "tp": 79, "fp": 0, "fn": 8 }, "high": { "tp": 296, "fp": 1, "fn": 420 }, "low": { "tp": 31, "fp": 0, "fn": 106 }, "medium": { "tp": 130, "fp": 0, "fn": 168 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 24.6, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 1.3737, "successful_runs": 98, "cost_per_run": 0.014, "total_loc_scanned": 154731, "cost_per_100_loc": 0.0007 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 517, "fp": 325, "fn": 720, "tn": 117, "precision": 0.614, "recall": 0.4179, "f2_score": 44.6, "f3_score": 43.2, "cvss_precision": 0.6695, "cvss_recall": 0.4545, "cvss_f3_score": 47.0 }, "strict_micro": { "tp": 517, "fp": 325, "fn": 720, "tn": 117, "precision": 0.614, "recall": 0.4179, "f2_score": 44.6, "f3_score": 43.2, "cvss_precision": 0.6695, "cvss_recall": 0.4545, "cvss_f3_score": 47.0 }, "macro": { "f2_score": 47.8 }, "per_severity": { "critical": { "tp": 72, "fp": 2, "fn": 15 }, "high": { "tp": 301, "fp": 1, "fn": 415 }, "low": { "tp": 26, "fp": 0, "fn": 111 }, "medium": { "tp": 121, "fp": 1, "fn": 177 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.3, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 10.4348, "successful_runs": 95, "cost_per_run": 0.1098, "total_loc_scanned": 154731, "cost_per_100_loc": 0.0056 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 627, "fp": 503, "fn": 611, "tn": 121, "precision": 0.5549, "recall": 0.5065, "f2_score": 51.5, "f3_score": 51.1, "cvss_precision": 0.5993, "cvss_recall": 0.5385, "cvss_f3_score": 54.4 }, "strict_micro": { "tp": 627, "fp": 503, "fn": 611, "tn": 121, "precision": 0.5549, "recall": 0.5065, "f2_score": 51.5, "f3_score": 51.1, "cvss_precision": 0.5993, "cvss_recall": 0.5385, "cvss_f3_score": 54.4 }, "macro": { "f2_score": 54.4 }, "per_severity": { "critical": { "tp": 78, "fp": 0, "fn": 9 }, "high": { "tp": 360, "fp": 0, "fn": 356 }, "low": { "tp": 26, "fp": 0, "fn": 111 }, "medium": { "tp": 163, "fp": 0, "fn": 135 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 22.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 50, "cost_per_run": 0.0, "total_loc_scanned": 154731, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 227, "fp": 40, "fn": 449, "tn": 114, "precision": 0.8502, "recall": 0.3358, "f2_score": 38.2, "f3_score": 35.7, "cvss_precision": 0.8822, "cvss_recall": 0.3759, "cvss_f3_score": 39.9 }, "strict_micro": { "tp": 227, "fp": 40, "fn": 1011, "tn": 118, "precision": 0.8502, "recall": 0.1834, "f2_score": 21.7, "f3_score": 19.9, "cvss_precision": 0.8822, "cvss_recall": 0.2075, "cvss_f3_score": 22.5 }, "macro": { "f2_score": 42.6 }, "per_severity": { "critical": { "tp": 62, "fp": 0, "fn": 20 }, "high": { "tp": 100, "fp": 2, "fn": 156 }, "low": { "tp": 4, "fp": 0, "fn": 62 }, "medium": { "tp": 51, "fp": 0, "fn": 221 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 16.3, "num_runs": 3, "language_coverage": { "python": [ 25, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 20.4666, "successful_runs": 57, "cost_per_run": 0.3591, "total_loc_scanned": 19969, "cost_per_100_loc": 0.0523 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 185, "fp": 22, "fn": 518, "tn": 118, "precision": 0.8937, "recall": 0.2632, "f2_score": 30.6, "f3_score": 28.3, "cvss_precision": 0.9286, "cvss_recall": 0.3011, "cvss_f3_score": 32.3 }, "strict_micro": { "tp": 185, "fp": 22, "fn": 1053, "tn": 118, "precision": 0.8937, "recall": 0.1494, "f2_score": 17.9, "f3_score": 16.3, "cvss_precision": 0.9286, "cvss_recall": 0.1725, "cvss_f3_score": 18.8 }, "macro": { "f2_score": 35.3 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 35 }, "high": { "tp": 85, "fp": 1, "fn": 180 }, "low": { "tp": 2, "fp": 0, "fn": 66 }, "medium": { "tp": 46, "fp": 1, "fn": 237 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 19.3, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 26, "cost_per_run": 0.0, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 254, "fp": 105, "fn": 283, "tn": 90, "precision": 0.7075, "recall": 0.473, "f2_score": 50.7, "f3_score": 48.9, "cvss_precision": 0.7629, "cvss_recall": 0.5203, "cvss_f3_score": 53.7 }, "strict_micro": { "tp": 254, "fp": 105, "fn": 984, "tn": 119, "precision": 0.7075, "recall": 0.2052, "f2_score": 23.9, "f3_score": 22.1, "cvss_precision": 0.7629, "cvss_recall": 0.2286, "cvss_f3_score": 24.6 }, "macro": { "f2_score": 54.4 }, "per_severity": { "critical": { "tp": 60, "fp": 1, "fn": 11 }, "high": { "tp": 116, "fp": 0, "fn": 93 }, "low": { "tp": 5, "fp": 0, "fn": 40 }, "medium": { "tp": 68, "fp": 0, "fn": 144 } }, "repos_scored": 22, "repos_total": 50, "f2_stddev": 11.4, "num_runs": 3, "language_coverage": { "python": [ 22, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 4.6757, "successful_runs": 66, "cost_per_run": 0.0708, "total_loc_scanned": 15357, "cost_per_100_loc": 0.0101 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 393, "fp": 135, "fn": 295, "tn": 113, "precision": 0.7443, "recall": 0.5712, "f2_score": 59.9, "f3_score": 58.5, "cvss_precision": 0.7997, "cvss_recall": 0.6053, "cvss_f3_score": 62.0 }, "strict_micro": { "tp": 393, "fp": 135, "fn": 845, "tn": 117, "precision": 0.7443, "recall": 0.3174, "f2_score": 35.9, "f3_score": 33.7, "cvss_precision": 0.7997, "cvss_recall": 0.3388, "cvss_f3_score": 36.0 }, "macro": { "f2_score": 64.2 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 7 }, "high": { "tp": 163, "fp": 3, "fn": 96 }, "low": { "tp": 22, "fp": 0, "fn": 44 }, "medium": { "tp": 128, "fp": 2, "fn": 149 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 18.6, "num_runs": 3, "language_coverage": { "python": [ 25, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 10.6071, "successful_runs": 75, "cost_per_run": 0.1414, "total_loc_scanned": 19610, "cost_per_100_loc": 0.018 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 367, "fp": 184, "fn": 336, "tn": 118, "precision": 0.6661, "recall": 0.522, "f2_score": 54.6, "f3_score": 53.4, "cvss_precision": 0.7379, "cvss_recall": 0.5637, "cvss_f3_score": 57.7 }, "strict_micro": { "tp": 367, "fp": 184, "fn": 871, "tn": 118, "precision": 0.6661, "recall": 0.2964, "f2_score": 33.3, "f3_score": 31.4, "cvss_precision": 0.7379, "cvss_recall": 0.3229, "cvss_f3_score": 34.2 }, "macro": { "f2_score": 58.3 }, "per_severity": { "critical": { "tp": 76, "fp": 2, "fn": 11 }, "high": { "tp": 166, "fp": 1, "fn": 99 }, "low": { "tp": 24, "fp": 0, "fn": 44 }, "medium": { "tp": 148, "fp": 1, "fn": 135 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 15.4, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 11.1992, "successful_runs": 77, "cost_per_run": 0.1454, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0204 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 684, "fp": 766, "fn": 477, "tn": 118, "precision": 0.4717, "recall": 0.5891, "f2_score": 56.1, "f3_score": 57.5, "cvss_precision": 0.529, "cvss_recall": 0.6204, "cvss_f3_score": 61.0 }, "strict_micro": { "tp": 684, "fp": 766, "fn": 554, "tn": 118, "precision": 0.4717, "recall": 0.5525, "f2_score": 53.4, "f3_score": 54.3, "cvss_precision": 0.529, "cvss_recall": 0.584, "cvss_f3_score": 57.8 }, "macro": { "f2_score": 58.1 }, "per_severity": { "critical": { "tp": 81, "fp": 2, "fn": 6 }, "high": { "tp": 389, "fp": 0, "fn": 274 }, "low": { "tp": 37, "fp": 0, "fn": 78 }, "medium": { "tp": 177, "fp": 1, "fn": 119 } }, "repos_scored": 49, "repos_total": 50, "f2_stddev": 19.8, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 23, 24 ] }, "cost": { "total_cost": 22.9071, "successful_runs": 49, "cost_per_run": 0.4675, "total_loc_scanned": 152223, "cost_per_100_loc": 0.015 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 410, "fp": 77, "fn": 293, "tn": 121, "precision": 0.8419, "recall": 0.5832, "f2_score": 62.1, "f3_score": 60.2, "cvss_precision": 0.8856, "cvss_recall": 0.6282, "cvss_f3_score": 64.7 }, "strict_micro": { "tp": 410, "fp": 77, "fn": 828, "tn": 121, "precision": 0.8419, "recall": 0.3312, "f2_score": 37.7, "f3_score": 35.3, "cvss_precision": 0.8856, "cvss_recall": 0.3598, "cvss_f3_score": 38.3 }, "macro": { "f2_score": 65.6 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 8 }, "high": { "tp": 162, "fp": 0, "fn": 103 }, "low": { "tp": 23, "fp": 0, "fn": 45 }, "medium": { "tp": 153, "fp": 0, "fn": 130 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 15.8, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 66.4528, "successful_runs": 76, "cost_per_run": 0.8744, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1115 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 255, "fp": 38, "fn": 448, "tn": 121, "precision": 0.8703, "recall": 0.3627, "f2_score": 41.1, "f3_score": 38.5, "cvss_precision": 0.9137, "cvss_recall": 0.4107, "cvss_f3_score": 43.5 }, "strict_micro": { "tp": 255, "fp": 38, "fn": 983, "tn": 121, "precision": 0.8703, "recall": 0.206, "f2_score": 24.3, "f3_score": 22.3, "cvss_precision": 0.9137, "cvss_recall": 0.2352, "cvss_f3_score": 25.4 }, "macro": { "f2_score": 46.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 22 }, "high": { "tp": 113, "fp": 0, "fn": 152 }, "low": { "tp": 3, "fp": 0, "fn": 65 }, "medium": { "tp": 74, "fp": 0, "fn": 209 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.3308, "successful_runs": 26, "cost_per_run": 0.0127, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0016 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 863, "fp": 551, "fn": 375, "tn": 120, "precision": 0.6103, "recall": 0.6971, "f2_score": 67.8, "f3_score": 68.7, "cvss_precision": 0.6435, "cvss_recall": 0.7106, "cvss_f3_score": 70.3 }, "strict_micro": { "tp": 863, "fp": 551, "fn": 375, "tn": 120, "precision": 0.6103, "recall": 0.6971, "f2_score": 67.8, "f3_score": 68.7, "cvss_precision": 0.6435, "cvss_recall": 0.7106, "cvss_f3_score": 70.3 }, "macro": { "f2_score": 70.0 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 519, "fp": 0, "fn": 197 }, "low": { "tp": 80, "fp": 0, "fn": 57 }, "medium": { "tp": 187, "fp": 1, "fn": 111 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 21.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 119.1609, "successful_runs": 50, "cost_per_run": 2.3832, "total_loc_scanned": 154731, "cost_per_100_loc": 0.077 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 325, "fp": 61, "fn": 378, "tn": 121, "precision": 0.842, "recall": 0.4623, "f2_score": 50.8, "f3_score": 48.4, "cvss_precision": 0.8834, "cvss_recall": 0.5063, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 325, "fp": 61, "fn": 913, "tn": 121, "precision": 0.842, "recall": 0.2625, "f2_score": 30.4, "f3_score": 28.2, "cvss_precision": 0.8834, "cvss_recall": 0.29, "cvss_f3_score": 31.1 }, "macro": { "f2_score": 57.2 }, "per_severity": { "critical": { "tp": 72, "fp": 0, "fn": 15 }, "high": { "tp": 129, "fp": 0, "fn": 136 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 112, "fp": 0, "fn": 171 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 20.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 7.2965, "successful_runs": 26, "cost_per_run": 0.2806, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0364 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 626, "fp": 662, "fn": 612, "tn": 120, "precision": 0.486, "recall": 0.5057, "f2_score": 50.2, "f3_score": 50.4, "cvss_precision": 0.527, "cvss_recall": 0.5396, "cvss_f3_score": 53.8 }, "strict_micro": { "tp": 626, "fp": 662, "fn": 612, "tn": 120, "precision": 0.486, "recall": 0.5057, "f2_score": 50.2, "f3_score": 50.4, "cvss_precision": 0.527, "cvss_recall": 0.5396, "cvss_f3_score": 53.8 }, "macro": { "f2_score": 54.6 }, "per_severity": { "critical": { "tp": 74, "fp": 0, "fn": 13 }, "high": { "tp": 381, "fp": 0, "fn": 335 }, "low": { "tp": 23, "fp": 0, "fn": 114 }, "medium": { "tp": 148, "fp": 1, "fn": 150 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 19.4, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 202.9904, "successful_runs": 50, "cost_per_run": 4.0598, "total_loc_scanned": 154731, "cost_per_100_loc": 0.1312 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 909, "fp": 493, "fn": 329, "tn": 120, "precision": 0.6484, "recall": 0.7342, "f2_score": 71.5, "f3_score": 72.5, "cvss_precision": 0.6803, "cvss_recall": 0.745, "cvss_f3_score": 73.8 }, "strict_micro": { "tp": 909, "fp": 493, "fn": 329, "tn": 120, "precision": 0.6484, "recall": 0.7342, "f2_score": 71.5, "f3_score": 72.5, "cvss_precision": 0.6803, "cvss_recall": 0.745, "cvss_f3_score": 73.8 }, "macro": { "f2_score": 73.5 }, "per_severity": { "critical": { "tp": 76, "fp": 0, "fn": 11 }, "high": { "tp": 557, "fp": 0, "fn": 159 }, "low": { "tp": 88, "fp": 0, "fn": 49 }, "medium": { "tp": 188, "fp": 1, "fn": 110 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 20.4, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 120.2208, "successful_runs": 50, "cost_per_run": 2.4044, "total_loc_scanned": 154731, "cost_per_100_loc": 0.0777 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 343, "fp": 157, "fn": 360, "tn": 112, "precision": 0.686, "recall": 0.4879, "f2_score": 51.8, "f3_score": 50.2, "cvss_precision": 0.7557, "cvss_recall": 0.5263, "cvss_f3_score": 54.3 }, "strict_micro": { "tp": 343, "fp": 157, "fn": 895, "tn": 112, "precision": 0.686, "recall": 0.2771, "f2_score": 31.5, "f3_score": 29.5, "cvss_precision": 0.7557, "cvss_recall": 0.3014, "cvss_f3_score": 32.1 }, "macro": { "f2_score": 54.0 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 130, "fp": 6, "fn": 135 }, "low": { "tp": 17, "fp": 0, "fn": 51 }, "medium": { "tp": 108, "fp": 0, "fn": 175 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 13.2, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 2.2441, "successful_runs": 76, "cost_per_run": 0.0295, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0039 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 389, "fp": 102, "fn": 314, "tn": 118, "precision": 0.7923, "recall": 0.5533, "f2_score": 58.9, "f3_score": 57.1, "cvss_precision": 0.847, "cvss_recall": 0.5936, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 389, "fp": 102, "fn": 849, "tn": 118, "precision": 0.7923, "recall": 0.3142, "f2_score": 35.7, "f3_score": 33.4, "cvss_precision": 0.847, "cvss_recall": 0.34, "cvss_f3_score": 36.2 }, "macro": { "f2_score": 61.2 }, "per_severity": { "critical": { "tp": 68, "fp": 1, "fn": 19 }, "high": { "tp": 143, "fp": 3, "fn": 122 }, "low": { "tp": 11, "fp": 0, "fn": 57 }, "medium": { "tp": 129, "fp": 1, "fn": 154 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.7, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 6.4923, "successful_runs": 65, "cost_per_run": 0.0999, "total_loc_scanned": 19609, "cost_per_100_loc": 0.0132 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 385, "fp": 174, "fn": 318, "tn": 118, "precision": 0.6887, "recall": 0.5477, "f2_score": 57.1, "f3_score": 55.9, "cvss_precision": 0.7721, "cvss_recall": 0.5935, "cvss_f3_score": 60.8 }, "strict_micro": { "tp": 385, "fp": 174, "fn": 853, "tn": 118, "precision": 0.6887, "recall": 0.311, "f2_score": 34.9, "f3_score": 32.9, "cvss_precision": 0.7721, "cvss_recall": 0.3399, "cvss_f3_score": 36.0 }, "macro": { "f2_score": 60.8 }, "per_severity": { "critical": { "tp": 73, "fp": 1, "fn": 14 }, "high": { "tp": 171, "fp": 1, "fn": 94 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 143, "fp": 1, "fn": 140 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 11.9, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 8.0951, "successful_runs": 78, "cost_per_run": 0.1038, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0135 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 398, "fp": 93, "fn": 305, "tn": 119, "precision": 0.8106, "recall": 0.5661, "f2_score": 60.2, "f3_score": 58.4, "cvss_precision": 0.8681, "cvss_recall": 0.6039, "cvss_f3_score": 62.3 }, "strict_micro": { "tp": 398, "fp": 93, "fn": 840, "tn": 119, "precision": 0.8106, "recall": 0.3215, "f2_score": 36.6, "f3_score": 34.2, "cvss_precision": 0.8681, "cvss_recall": 0.3459, "cvss_f3_score": 36.8 }, "macro": { "f2_score": 64.0 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 158, "fp": 2, "fn": 107 }, "low": { "tp": 28, "fp": 0, "fn": 40 }, "medium": { "tp": 135, "fp": 0, "fn": 148 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 20.7, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 5.7512, "successful_runs": 26, "cost_per_run": 0.2212, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0287 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 309, "fp": 127, "fn": 394, "tn": 117, "precision": 0.7087, "recall": 0.4395, "f2_score": 47.6, "f3_score": 45.7, "cvss_precision": 0.716, "cvss_recall": 0.4831, "cvss_f3_score": 49.9 }, "strict_micro": { "tp": 309, "fp": 127, "fn": 929, "tn": 117, "precision": 0.7087, "recall": 0.2496, "f2_score": 28.7, "f3_score": 26.7, "cvss_precision": 0.716, "cvss_recall": 0.2767, "cvss_f3_score": 29.5 }, "macro": { "f2_score": 53.3 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 133, "fp": 2, "fn": 132 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 90, "fp": 1, "fn": 193 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 72.7434, "successful_runs": 26, "cost_per_run": 2.7978, "total_loc_scanned": 20062, "cost_per_100_loc": 0.3626 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 521, "fp": 996, "fn": 182, "tn": 117, "precision": 0.3434, "recall": 0.7411, "f2_score": 60.2, "f3_score": 66.4, "cvss_precision": 0.3392, "cvss_recall": 0.7588, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 521, "fp": 996, "fn": 717, "tn": 117, "precision": 0.3434, "recall": 0.4208, "f2_score": 40.3, "f3_score": 41.2, "cvss_precision": 0.3392, "cvss_recall": 0.4346, "cvss_f3_score": 42.3 }, "macro": { "f2_score": 61.6 }, "per_severity": { "critical": { "tp": 75, "fp": 2, "fn": 12 }, "high": { "tp": 197, "fp": 1, "fn": 68 }, "low": { "tp": 40, "fp": 0, "fn": 28 }, "medium": { "tp": 209, "fp": 1, "fn": 74 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 10.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 25.655, "successful_runs": 26, "cost_per_run": 0.9867, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1279 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 445, "fp": 524, "fn": 258, "tn": 119, "precision": 0.4592, "recall": 0.633, "f2_score": 58.8, "f3_score": 61.0, "cvss_precision": 0.4615, "cvss_recall": 0.6545, "cvss_f3_score": 62.8 }, "strict_micro": { "tp": 445, "fp": 524, "fn": 793, "tn": 119, "precision": 0.4592, "recall": 0.3595, "f2_score": 37.6, "f3_score": 36.7, "cvss_precision": 0.4615, "cvss_recall": 0.3749, "cvss_f3_score": 38.2 }, "macro": { "f2_score": 62.5 }, "per_severity": { "critical": { "tp": 71, "fp": 0, "fn": 16 }, "high": { "tp": 172, "fp": 2, "fn": 93 }, "low": { "tp": 31, "fp": 0, "fn": 37 }, "medium": { "tp": 171, "fp": 0, "fn": 112 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 14.4, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 3.9098, "successful_runs": 26, "cost_per_run": 0.1504, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0195 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 125, "fp": 62, "fn": 578, "tn": 121, "precision": 0.6684, "recall": 0.1778, "f2_score": 20.8, "f3_score": 19.2, "cvss_precision": 0.6483, "cvss_recall": 0.2027, "cvss_f3_score": 21.8 }, "strict_micro": { "tp": 125, "fp": 62, "fn": 1113, "tn": 121, "precision": 0.6684, "recall": 0.101, "f2_score": 12.2, "f3_score": 11.0, "cvss_precision": 0.6483, "cvss_recall": 0.1161, "cvss_f3_score": 12.6 }, "macro": { "f2_score": 24.7 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 52 }, "high": { "tp": 53, "fp": 0, "fn": 212 }, "low": { "tp": 1, "fp": 0, "fn": 67 }, "medium": { "tp": 36, "fp": 0, "fn": 247 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 16.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 586, "fp": 1145, "fn": 117, "tn": 103, "precision": 0.3385, "recall": 0.8336, "f2_score": 64.5, "f3_score": 72.7, "cvss_precision": 0.3176, "cvss_recall": 0.8478, "cvss_f3_score": 72.7 }, "strict_micro": { "tp": 586, "fp": 1145, "fn": 652, "tn": 103, "precision": 0.3385, "recall": 0.4733, "f2_score": 43.8, "f3_score": 45.5, "cvss_precision": 0.3176, "cvss_recall": 0.4856, "cvss_f3_score": 46.1 }, "macro": { "f2_score": 66.4 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 227, "fp": 6, "fn": 38 }, "low": { "tp": 46, "fp": 1, "fn": 22 }, "medium": { "tp": 229, "fp": 6, "fn": 54 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 1089, "fp": 840, "fn": 149, "tn": 119, "precision": 0.5645, "recall": 0.8796, "f2_score": 79.1, "f3_score": 83.3, "cvss_precision": 0.5293, "cvss_recall": 0.8769, "cvss_f3_score": 82.3 }, "strict_micro": { "tp": 1089, "fp": 840, "fn": 149, "tn": 119, "precision": 0.5645, "recall": 0.8796, "f2_score": 79.1, "f3_score": 83.3, "cvss_precision": 0.5293, "cvss_recall": 0.8769, "cvss_f3_score": 82.3 }, "macro": { "f2_score": 78.9 }, "per_severity": { "critical": { "tp": 76, "fp": 1, "fn": 11 }, "high": { "tp": 630, "fp": 1, "fn": 86 }, "low": { "tp": 127, "fp": 0, "fn": 10 }, "medium": { "tp": 256, "fp": 0, "fn": 42 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 12.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 361, "fp": 296, "fn": 342, "tn": 120, "precision": 0.5495, "recall": 0.5135, "f2_score": 52.0, "f3_score": 51.7, "cvss_precision": 0.5427, "cvss_recall": 0.5414, "cvss_f3_score": 54.2 }, "strict_micro": { "tp": 361, "fp": 296, "fn": 877, "tn": 120, "precision": 0.5495, "recall": 0.2916, "f2_score": 32.2, "f3_score": 30.6, "cvss_precision": 0.5427, "cvss_recall": 0.3101, "cvss_f3_score": 32.4 }, "macro": { "f2_score": 56.1 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 21 }, "high": { "tp": 150, "fp": 1, "fn": 115 }, "low": { "tp": 21, "fp": 0, "fn": 47 }, "medium": { "tp": 124, "fp": 0, "fn": 159 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 17.7, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 595, "fp": 1344, "fn": 108, "tn": 103, "precision": 0.3069, "recall": 0.8464, "f2_score": 62.6, "f3_score": 72.0, "cvss_precision": 0.292, "cvss_recall": 0.8574, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 595, "fp": 1344, "fn": 643, "tn": 103, "precision": 0.3069, "recall": 0.4806, "f2_score": 43.2, "f3_score": 45.5, "cvss_precision": 0.292, "cvss_recall": 0.4911, "cvss_f3_score": 46.0 }, "macro": { "f2_score": 64.1 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 228, "fp": 6, "fn": 37 }, "low": { "tp": 50, "fp": 1, "fn": 18 }, "medium": { "tp": 233, "fp": 6, "fn": 50 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 9.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 276, "fp": 110, "fn": 427, "tn": 116, "precision": 0.715, "recall": 0.3926, "f2_score": 43.2, "f3_score": 41.1, "cvss_precision": 0.7684, "cvss_recall": 0.4311, "cvss_f3_score": 45.1 }, "strict_micro": { "tp": 276, "fp": 110, "fn": 962, "tn": 116, "precision": 0.715, "recall": 0.2229, "f2_score": 25.9, "f3_score": 23.9, "cvss_precision": 0.7684, "cvss_recall": 0.2469, "cvss_f3_score": 26.5 }, "macro": { "f2_score": 45.6 }, "per_severity": { "critical": { "tp": 67, "fp": 1, "fn": 20 }, "high": { "tp": 119, "fp": 4, "fn": 146 }, "low": { "tp": 10, "fp": 0, "fn": 58 }, "medium": { "tp": 89, "fp": 2, "fn": 194 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 13.0, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 1.8883, "successful_runs": 63, "cost_per_run": 0.03, "total_loc_scanned": 18429, "cost_per_100_loc": 0.0049 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 193, "fp": 155, "fn": 381, "tn": 96, "precision": 0.5546, "recall": 0.3362, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6294, "cvss_recall": 0.3629, "cvss_f3_score": 37.9 }, "strict_micro": { "tp": 193, "fp": 155, "fn": 1045, "tn": 114, "precision": 0.5546, "recall": 0.1559, "f2_score": 18.2, "f3_score": 16.8, "cvss_precision": 0.6294, "cvss_recall": 0.172, "cvss_f3_score": 18.5 }, "macro": { "f2_score": 38.6 }, "per_severity": { "critical": { "tp": 46, "fp": 1, "fn": 33 }, "high": { "tp": 78, "fp": 3, "fn": 145 }, "low": { "tp": 9, "fp": 0, "fn": 41 }, "medium": { "tp": 60, "fp": 3, "fn": 162 } }, "repos_scored": 22, "repos_total": 50, "f2_stddev": 26.4, "num_runs": 1, "language_coverage": { "python": [ 22, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 22, "cost_per_run": 0.0, "total_loc_scanned": 16343, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 272, "fp": 132, "fn": 395, "tn": 108, "precision": 0.6733, "recall": 0.4078, "f2_score": 44.3, "f3_score": 42.5, "cvss_precision": 0.7478, "cvss_recall": 0.4426, "cvss_f3_score": 46.1 }, "strict_micro": { "tp": 272, "fp": 132, "fn": 966, "tn": 112, "precision": 0.6733, "recall": 0.2197, "f2_score": 25.4, "f3_score": 23.6, "cvss_precision": 0.7478, "cvss_recall": 0.2403, "cvss_f3_score": 25.8 }, "macro": { "f2_score": 52.1 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 31 }, "high": { "tp": 120, "fp": 7, "fn": 131 }, "low": { "tp": 15, "fp": 1, "fn": 52 }, "medium": { "tp": 85, "fp": 0, "fn": 181 } }, "repos_scored": 25, "repos_total": 50, "f2_stddev": 21.1, "num_runs": 1, "language_coverage": { "python": [ 25, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 25, "cost_per_run": 0.0, "total_loc_scanned": 18055, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 148, "fp": 465, "fn": 520, "tn": 103, "precision": 0.2414, "recall": 0.2216, "f2_score": 22.5, "f3_score": 22.3, "cvss_precision": 0.4253, "cvss_recall": 0.2486, "cvss_f3_score": 25.9 }, "strict_micro": { "tp": 148, "fp": 465, "fn": 1090, "tn": 110, "precision": 0.2414, "recall": 0.1195, "f2_score": 13.3, "f3_score": 12.6, "cvss_precision": 0.4253, "cvss_recall": 0.1345, "cvss_f3_score": 14.4 }, "macro": { "f2_score": 23.3 }, "per_severity": { "critical": { "tp": 51, "fp": 2, "fn": 31 }, "high": { "tp": 44, "fp": 7, "fn": 207 }, "low": { "tp": 6, "fp": 0, "fn": 60 }, "medium": { "tp": 47, "fp": 2, "fn": 222 } }, "repos_scored": 24, "repos_total": 50, "f2_stddev": 11.7, "num_runs": 1, "language_coverage": { "python": [ 24, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 220, "fp": 1444, "fn": 1018, "tn": 116, "precision": 0.1322, "recall": 0.1777, "f2_score": 16.6, "f3_score": 17.2, "cvss_precision": 0.1563, "cvss_recall": 0.1969, "cvss_f3_score": 19.2 }, "strict_micro": { "tp": 220, "fp": 1444, "fn": 1018, "tn": 116, "precision": 0.1322, "recall": 0.1777, "f2_score": 16.6, "f3_score": 17.2, "cvss_precision": 0.1563, "cvss_recall": 0.1969, "cvss_f3_score": 19.2 }, "macro": { "f2_score": 16.8 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 46 }, "high": { "tp": 129, "fp": 4, "fn": 587 }, "low": { "tp": 3, "fp": 0, "fn": 134 }, "medium": { "tp": 47, "fp": 1, "fn": 251 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 15.0, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 44, "fp": 28, "fn": 659, "tn": 120, "precision": 0.6111, "recall": 0.0626, "f2_score": 7.6, "f3_score": 6.9, "cvss_precision": 0.5584, "cvss_recall": 0.0705, "cvss_f3_score": 7.7 }, "strict_micro": { "tp": 44, "fp": 28, "fn": 1194, "tn": 120, "precision": 0.6111, "recall": 0.0355, "f2_score": 4.4, "f3_score": 3.9, "cvss_precision": 0.5584, "cvss_recall": 0.0404, "cvss_f3_score": 4.4 }, "macro": { "f2_score": 6.4 }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 77 }, "high": { "tp": 14, "fp": 0, "fn": 251 }, "low": { "tp": 0, "fp": 0, "fn": 68 }, "medium": { "tp": 20, "fp": 1, "fn": 263 } }, "repos_scored": 26, "repos_total": 50, "f2_stddev": 11.6, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ], "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "python:intentional": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 487, "fp": 331, "fn": 216, "tn": 117, "precision": 0.5954, "recall": 0.6927, "f2_score": 67.1, "f3_score": 68.2, "cvss_precision": 0.6605, "cvss_recall": 0.7246, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 487, "fp": 331, "fn": 216, "tn": 117, "precision": 0.5954, "recall": 0.6927, "f2_score": 67.1, "f3_score": 68.2, "cvss_precision": 0.6605, "cvss_recall": 0.7246, "cvss_f3_score": 71.8 }, "macro": { "f2_score": 70.5 }, "per_severity": { "critical": { "tp": 80, "fp": 2, "fn": 7 }, "high": { "tp": 187, "fp": 1, "fn": 78 }, "low": { "tp": 35, "fp": 0, "fn": 33 }, "medium": { "tp": 185, "fp": 1, "fn": 98 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 24.5673, "successful_runs": 26, "cost_per_run": 0.9449, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1225 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 335, "fp": 143, "fn": 368, "tn": 118, "precision": 0.7008, "recall": 0.4765, "f2_score": 50.9, "f3_score": 49.2, "cvss_precision": 0.7642, "cvss_recall": 0.5204, "cvss_f3_score": 53.8 }, "strict_micro": { "tp": 335, "fp": 143, "fn": 368, "tn": 118, "precision": 0.7008, "recall": 0.4765, "f2_score": 50.9, "f3_score": 49.2, "cvss_precision": 0.7642, "cvss_recall": 0.5204, "cvss_f3_score": 53.8 }, "macro": { "f2_score": 54.0 }, "per_severity": { "critical": { "tp": 74, "fp": 1, "fn": 13 }, "high": { "tp": 137, "fp": 1, "fn": 128 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 109, "fp": 1, "fn": 174 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 18.5, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 9.3213, "successful_runs": 26, "cost_per_run": 0.3585, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0465 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 385, "fp": 125, "fn": 318, "tn": 118, "precision": 0.7549, "recall": 0.5477, "f2_score": 57.9, "f3_score": 56.3, "cvss_precision": 0.8176, "cvss_recall": 0.5807, "cvss_f3_score": 59.8 }, "strict_micro": { "tp": 385, "fp": 125, "fn": 318, "tn": 118, "precision": 0.7549, "recall": 0.5477, "f2_score": 57.9, "f3_score": 56.3, "cvss_precision": 0.8176, "cvss_recall": 0.5807, "cvss_f3_score": 59.8 }, "macro": { "f2_score": 62.6 }, "per_severity": { "critical": { "tp": 79, "fp": 0, "fn": 8 }, "high": { "tp": 147, "fp": 1, "fn": 118 }, "low": { "tp": 28, "fp": 0, "fn": 40 }, "medium": { "tp": 128, "fp": 0, "fn": 155 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 16.8, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.963, "successful_runs": 74, "cost_per_run": 0.013, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0018 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 356, "fp": 95, "fn": 346, "tn": 117, "precision": 0.7894, "recall": 0.5071, "f2_score": 54.6, "f3_score": 52.6, "cvss_precision": 0.8394, "cvss_recall": 0.5474, "cvss_f3_score": 56.7 }, "strict_micro": { "tp": 356, "fp": 95, "fn": 346, "tn": 117, "precision": 0.7894, "recall": 0.5071, "f2_score": 54.6, "f3_score": 52.6, "cvss_precision": 0.8394, "cvss_recall": 0.5474, "cvss_f3_score": 56.7 }, "macro": { "f2_score": 57.5 }, "per_severity": { "critical": { "tp": 72, "fp": 2, "fn": 15 }, "high": { "tp": 144, "fp": 1, "fn": 121 }, "low": { "tp": 24, "fp": 0, "fn": 44 }, "medium": { "tp": 119, "fp": 1, "fn": 164 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 12.9, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 9.5856, "successful_runs": 71, "cost_per_run": 0.135, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0191 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 434, "fp": 181, "fn": 269, "tn": 121, "precision": 0.7057, "recall": 0.6174, "f2_score": 63.3, "f3_score": 62.5, "cvss_precision": 0.7579, "cvss_recall": 0.6532, "cvss_f3_score": 66.2 }, "strict_micro": { "tp": 434, "fp": 181, "fn": 269, "tn": 121, "precision": 0.7057, "recall": 0.6174, "f2_score": 63.3, "f3_score": 62.5, "cvss_precision": 0.7579, "cvss_recall": 0.6532, "cvss_f3_score": 66.2 }, "macro": { "f2_score": 65.1 }, "per_severity": { "critical": { "tp": 78, "fp": 0, "fn": 9 }, "high": { "tp": 170, "fp": 0, "fn": 95 }, "low": { "tp": 23, "fp": 0, "fn": 45 }, "medium": { "tp": 163, "fp": 0, "fn": 120 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.3, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 26, "cost_per_run": 0.0, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 227, "fp": 40, "fn": 449, "tn": 114, "precision": 0.8502, "recall": 0.3358, "f2_score": 38.2, "f3_score": 35.7, "cvss_precision": 0.8822, "cvss_recall": 0.3759, "cvss_f3_score": 39.9 }, "strict_micro": { "tp": 227, "fp": 40, "fn": 476, "tn": 118, "precision": 0.8502, "recall": 0.3229, "f2_score": 36.9, "f3_score": 34.4, "cvss_precision": 0.8822, "cvss_recall": 0.3623, "cvss_f3_score": 38.5 }, "macro": { "f2_score": 42.6 }, "per_severity": { "critical": { "tp": 62, "fp": 0, "fn": 20 }, "high": { "tp": 100, "fp": 2, "fn": 156 }, "low": { "tp": 4, "fp": 0, "fn": 62 }, "medium": { "tp": 51, "fp": 0, "fn": 221 } }, "repos_scored": 25, "repos_total": 26, "f2_stddev": 16.3, "num_runs": 3, "language_coverage": { "python": [ 25, 26 ] }, "cost": { "total_cost": 20.4666, "successful_runs": 57, "cost_per_run": 0.3591, "total_loc_scanned": 19969, "cost_per_100_loc": 0.0523 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 185, "fp": 22, "fn": 518, "tn": 118, "precision": 0.8937, "recall": 0.2632, "f2_score": 30.6, "f3_score": 28.3, "cvss_precision": 0.9286, "cvss_recall": 0.3011, "cvss_f3_score": 32.3 }, "strict_micro": { "tp": 185, "fp": 22, "fn": 518, "tn": 118, "precision": 0.8937, "recall": 0.2632, "f2_score": 30.6, "f3_score": 28.3, "cvss_precision": 0.9286, "cvss_recall": 0.3011, "cvss_f3_score": 32.3 }, "macro": { "f2_score": 35.3 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 35 }, "high": { "tp": 85, "fp": 1, "fn": 180 }, "low": { "tp": 2, "fp": 0, "fn": 66 }, "medium": { "tp": 46, "fp": 1, "fn": 237 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 19.3, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 26, "cost_per_run": 0.0, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 254, "fp": 105, "fn": 283, "tn": 90, "precision": 0.7075, "recall": 0.473, "f2_score": 50.7, "f3_score": 48.9, "cvss_precision": 0.7629, "cvss_recall": 0.5203, "cvss_f3_score": 53.7 }, "strict_micro": { "tp": 254, "fp": 105, "fn": 449, "tn": 119, "precision": 0.7075, "recall": 0.3613, "f2_score": 40.1, "f3_score": 38.0, "cvss_precision": 0.7629, "cvss_recall": 0.3991, "cvss_f3_score": 41.9 }, "macro": { "f2_score": 54.4 }, "per_severity": { "critical": { "tp": 60, "fp": 1, "fn": 11 }, "high": { "tp": 116, "fp": 0, "fn": 93 }, "low": { "tp": 5, "fp": 0, "fn": 40 }, "medium": { "tp": 68, "fp": 0, "fn": 144 } }, "repos_scored": 22, "repos_total": 26, "f2_stddev": 11.4, "num_runs": 3, "language_coverage": { "python": [ 22, 26 ] }, "cost": { "total_cost": 4.6757, "successful_runs": 66, "cost_per_run": 0.0708, "total_loc_scanned": 15357, "cost_per_100_loc": 0.0101 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 393, "fp": 135, "fn": 295, "tn": 113, "precision": 0.7443, "recall": 0.5712, "f2_score": 59.9, "f3_score": 58.5, "cvss_precision": 0.7997, "cvss_recall": 0.6053, "cvss_f3_score": 62.0 }, "strict_micro": { "tp": 393, "fp": 135, "fn": 310, "tn": 117, "precision": 0.7443, "recall": 0.559, "f2_score": 58.8, "f3_score": 57.3, "cvss_precision": 0.7997, "cvss_recall": 0.5916, "cvss_f3_score": 60.7 }, "macro": { "f2_score": 64.2 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 7 }, "high": { "tp": 163, "fp": 3, "fn": 96 }, "low": { "tp": 22, "fp": 0, "fn": 44 }, "medium": { "tp": 128, "fp": 2, "fn": 149 } }, "repos_scored": 25, "repos_total": 26, "f2_stddev": 18.6, "num_runs": 3, "language_coverage": { "python": [ 25, 26 ] }, "cost": { "total_cost": 10.6071, "successful_runs": 75, "cost_per_run": 0.1414, "total_loc_scanned": 19610, "cost_per_100_loc": 0.018 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 367, "fp": 184, "fn": 336, "tn": 118, "precision": 0.6661, "recall": 0.522, "f2_score": 54.6, "f3_score": 53.4, "cvss_precision": 0.7379, "cvss_recall": 0.5637, "cvss_f3_score": 57.7 }, "strict_micro": { "tp": 367, "fp": 184, "fn": 336, "tn": 118, "precision": 0.6661, "recall": 0.522, "f2_score": 54.6, "f3_score": 53.4, "cvss_precision": 0.7379, "cvss_recall": 0.5637, "cvss_f3_score": 57.7 }, "macro": { "f2_score": 58.3 }, "per_severity": { "critical": { "tp": 76, "fp": 2, "fn": 11 }, "high": { "tp": 166, "fp": 1, "fn": 99 }, "low": { "tp": 24, "fp": 0, "fn": 44 }, "medium": { "tp": 148, "fp": 1, "fn": 135 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 15.4, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 11.1992, "successful_runs": 77, "cost_per_run": 0.1454, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0204 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 458, "fp": 284, "fn": 245, "tn": 118, "precision": 0.6173, "recall": 0.6515, "f2_score": 64.4, "f3_score": 64.8, "cvss_precision": 0.6918, "cvss_recall": 0.6856, "cvss_f3_score": 68.6 }, "strict_micro": { "tp": 458, "fp": 284, "fn": 245, "tn": 118, "precision": 0.6173, "recall": 0.6515, "f2_score": 64.4, "f3_score": 64.8, "cvss_precision": 0.6918, "cvss_recall": 0.6856, "cvss_f3_score": 68.6 }, "macro": { "f2_score": 66.8 }, "per_severity": { "critical": { "tp": 81, "fp": 2, "fn": 6 }, "high": { "tp": 173, "fp": 0, "fn": 92 }, "low": { "tp": 30, "fp": 0, "fn": 38 }, "medium": { "tp": 174, "fp": 1, "fn": 109 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 13.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 10.8409, "successful_runs": 26, "cost_per_run": 0.417, "total_loc_scanned": 20062, "cost_per_100_loc": 0.054 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 410, "fp": 77, "fn": 293, "tn": 121, "precision": 0.8419, "recall": 0.5832, "f2_score": 62.1, "f3_score": 60.2, "cvss_precision": 0.8856, "cvss_recall": 0.6282, "cvss_f3_score": 64.7 }, "strict_micro": { "tp": 410, "fp": 77, "fn": 293, "tn": 121, "precision": 0.8419, "recall": 0.5832, "f2_score": 62.1, "f3_score": 60.2, "cvss_precision": 0.8856, "cvss_recall": 0.6282, "cvss_f3_score": 64.7 }, "macro": { "f2_score": 65.6 }, "per_severity": { "critical": { "tp": 79, "fp": 1, "fn": 8 }, "high": { "tp": 162, "fp": 0, "fn": 103 }, "low": { "tp": 23, "fp": 0, "fn": 45 }, "medium": { "tp": 153, "fp": 0, "fn": 130 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 15.8, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 66.4528, "successful_runs": 76, "cost_per_run": 0.8744, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1115 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 255, "fp": 38, "fn": 448, "tn": 121, "precision": 0.8703, "recall": 0.3627, "f2_score": 41.1, "f3_score": 38.5, "cvss_precision": 0.9137, "cvss_recall": 0.4107, "cvss_f3_score": 43.5 }, "strict_micro": { "tp": 255, "fp": 38, "fn": 448, "tn": 121, "precision": 0.8703, "recall": 0.3627, "f2_score": 41.1, "f3_score": 38.5, "cvss_precision": 0.9137, "cvss_recall": 0.4107, "cvss_f3_score": 43.5 }, "macro": { "f2_score": 46.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 22 }, "high": { "tp": 113, "fp": 0, "fn": 152 }, "low": { "tp": 3, "fp": 0, "fn": 65 }, "medium": { "tp": 74, "fp": 0, "fn": 209 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.3308, "successful_runs": 26, "cost_per_run": 0.0127, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0016 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 466, "fp": 195, "fn": 237, "tn": 120, "precision": 0.705, "recall": 0.6629, "f2_score": 67.1, "f3_score": 66.7, "cvss_precision": 0.7693, "cvss_recall": 0.6899, "cvss_f3_score": 69.7 }, "strict_micro": { "tp": 466, "fp": 195, "fn": 237, "tn": 120, "precision": 0.705, "recall": 0.6629, "f2_score": 67.1, "f3_score": 66.7, "cvss_precision": 0.7693, "cvss_recall": 0.6899, "cvss_f3_score": 69.7 }, "macro": { "f2_score": 71.5 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 180, "fp": 0, "fn": 85 }, "low": { "tp": 27, "fp": 0, "fn": 41 }, "medium": { "tp": 182, "fp": 1, "fn": 101 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 20.0, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 53.5355, "successful_runs": 26, "cost_per_run": 2.0591, "total_loc_scanned": 20062, "cost_per_100_loc": 0.2669 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 325, "fp": 61, "fn": 378, "tn": 121, "precision": 0.842, "recall": 0.4623, "f2_score": 50.8, "f3_score": 48.4, "cvss_precision": 0.8834, "cvss_recall": 0.5063, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 325, "fp": 61, "fn": 378, "tn": 121, "precision": 0.842, "recall": 0.4623, "f2_score": 50.8, "f3_score": 48.4, "cvss_precision": 0.8834, "cvss_recall": 0.5063, "cvss_f3_score": 52.9 }, "macro": { "f2_score": 57.2 }, "per_severity": { "critical": { "tp": 72, "fp": 0, "fn": 15 }, "high": { "tp": 129, "fp": 0, "fn": 136 }, "low": { "tp": 12, "fp": 0, "fn": 56 }, "medium": { "tp": 112, "fp": 0, "fn": 171 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 20.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 7.2965, "successful_runs": 26, "cost_per_run": 0.2806, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0364 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 374, "fp": 222, "fn": 329, "tn": 120, "precision": 0.6275, "recall": 0.532, "f2_score": 54.9, "f3_score": 54.0, "cvss_precision": 0.6908, "cvss_recall": 0.5683, "cvss_f3_score": 57.9 }, "strict_micro": { "tp": 374, "fp": 222, "fn": 329, "tn": 120, "precision": 0.6275, "recall": 0.532, "f2_score": 54.9, "f3_score": 54.0, "cvss_precision": 0.6908, "cvss_recall": 0.5683, "cvss_f3_score": 57.9 }, "macro": { "f2_score": 58.5 }, "per_severity": { "critical": { "tp": 74, "fp": 0, "fn": 13 }, "high": { "tp": 139, "fp": 0, "fn": 126 }, "low": { "tp": 18, "fp": 0, "fn": 50 }, "medium": { "tp": 143, "fp": 1, "fn": 140 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 17.8, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 64.2083, "successful_runs": 26, "cost_per_run": 2.4695, "total_loc_scanned": 20062, "cost_per_100_loc": 0.32 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 455, "fp": 186, "fn": 248, "tn": 120, "precision": 0.7098, "recall": 0.6472, "f2_score": 65.9, "f3_score": 65.3, "cvss_precision": 0.7704, "cvss_recall": 0.6726, "cvss_f3_score": 68.1 }, "strict_micro": { "tp": 455, "fp": 186, "fn": 248, "tn": 120, "precision": 0.7098, "recall": 0.6472, "f2_score": 65.9, "f3_score": 65.3, "cvss_precision": 0.7704, "cvss_recall": 0.6726, "cvss_f3_score": 68.1 }, "macro": { "f2_score": 72.4 }, "per_severity": { "critical": { "tp": 76, "fp": 0, "fn": 11 }, "high": { "tp": 177, "fp": 0, "fn": 88 }, "low": { "tp": 26, "fp": 0, "fn": 42 }, "medium": { "tp": 176, "fp": 1, "fn": 107 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 20.6, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 55.0128, "successful_runs": 26, "cost_per_run": 2.1159, "total_loc_scanned": 20062, "cost_per_100_loc": 0.2742 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 343, "fp": 157, "fn": 360, "tn": 112, "precision": 0.686, "recall": 0.4879, "f2_score": 51.8, "f3_score": 50.2, "cvss_precision": 0.7557, "cvss_recall": 0.5263, "cvss_f3_score": 54.3 }, "strict_micro": { "tp": 343, "fp": 157, "fn": 360, "tn": 112, "precision": 0.686, "recall": 0.4879, "f2_score": 51.8, "f3_score": 50.2, "cvss_precision": 0.7557, "cvss_recall": 0.5263, "cvss_f3_score": 54.3 }, "macro": { "f2_score": 54.0 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 130, "fp": 6, "fn": 135 }, "low": { "tp": 17, "fp": 0, "fn": 51 }, "medium": { "tp": 108, "fp": 0, "fn": 175 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 13.2, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 2.2441, "successful_runs": 76, "cost_per_run": 0.0295, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0039 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 389, "fp": 102, "fn": 314, "tn": 118, "precision": 0.7923, "recall": 0.5533, "f2_score": 58.9, "f3_score": 57.1, "cvss_precision": 0.847, "cvss_recall": 0.5936, "cvss_f3_score": 61.2 }, "strict_micro": { "tp": 389, "fp": 102, "fn": 314, "tn": 118, "precision": 0.7923, "recall": 0.5533, "f2_score": 58.9, "f3_score": 57.1, "cvss_precision": 0.847, "cvss_recall": 0.5936, "cvss_f3_score": 61.2 }, "macro": { "f2_score": 61.2 }, "per_severity": { "critical": { "tp": 68, "fp": 1, "fn": 19 }, "high": { "tp": 143, "fp": 3, "fn": 122 }, "low": { "tp": 11, "fp": 0, "fn": 57 }, "medium": { "tp": 129, "fp": 1, "fn": 154 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.7, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 6.4923, "successful_runs": 65, "cost_per_run": 0.0999, "total_loc_scanned": 19609, "cost_per_100_loc": 0.0132 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 385, "fp": 174, "fn": 318, "tn": 118, "precision": 0.6887, "recall": 0.5477, "f2_score": 57.1, "f3_score": 55.9, "cvss_precision": 0.7721, "cvss_recall": 0.5935, "cvss_f3_score": 60.8 }, "strict_micro": { "tp": 385, "fp": 174, "fn": 318, "tn": 118, "precision": 0.6887, "recall": 0.5477, "f2_score": 57.1, "f3_score": 55.9, "cvss_precision": 0.7721, "cvss_recall": 0.5935, "cvss_f3_score": 60.8 }, "macro": { "f2_score": 60.8 }, "per_severity": { "critical": { "tp": 73, "fp": 1, "fn": 14 }, "high": { "tp": 171, "fp": 1, "fn": 94 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 143, "fp": 1, "fn": 140 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 11.9, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 8.0951, "successful_runs": 78, "cost_per_run": 0.1038, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0135 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 398, "fp": 93, "fn": 305, "tn": 119, "precision": 0.8106, "recall": 0.5661, "f2_score": 60.2, "f3_score": 58.4, "cvss_precision": 0.8681, "cvss_recall": 0.6039, "cvss_f3_score": 62.3 }, "strict_micro": { "tp": 398, "fp": 93, "fn": 305, "tn": 119, "precision": 0.8106, "recall": 0.5661, "f2_score": 60.2, "f3_score": 58.4, "cvss_precision": 0.8681, "cvss_recall": 0.6039, "cvss_f3_score": 62.3 }, "macro": { "f2_score": 64.0 }, "per_severity": { "critical": { "tp": 77, "fp": 0, "fn": 10 }, "high": { "tp": 158, "fp": 2, "fn": 107 }, "low": { "tp": 28, "fp": 0, "fn": 40 }, "medium": { "tp": 135, "fp": 0, "fn": 148 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 20.7, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 5.7512, "successful_runs": 26, "cost_per_run": 0.2212, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0287 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 309, "fp": 127, "fn": 394, "tn": 117, "precision": 0.7087, "recall": 0.4395, "f2_score": 47.6, "f3_score": 45.7, "cvss_precision": 0.716, "cvss_recall": 0.4831, "cvss_f3_score": 49.9 }, "strict_micro": { "tp": 309, "fp": 127, "fn": 394, "tn": 117, "precision": 0.7087, "recall": 0.4395, "f2_score": 47.6, "f3_score": 45.7, "cvss_precision": 0.716, "cvss_recall": 0.4831, "cvss_f3_score": 49.9 }, "macro": { "f2_score": 53.3 }, "per_severity": { "critical": { "tp": 71, "fp": 1, "fn": 16 }, "high": { "tp": 133, "fp": 2, "fn": 132 }, "low": { "tp": 15, "fp": 0, "fn": 53 }, "medium": { "tp": 90, "fp": 1, "fn": 193 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 72.7434, "successful_runs": 26, "cost_per_run": 2.7978, "total_loc_scanned": 20062, "cost_per_100_loc": 0.3626 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 521, "fp": 996, "fn": 182, "tn": 117, "precision": 0.3434, "recall": 0.7411, "f2_score": 60.2, "f3_score": 66.4, "cvss_precision": 0.3392, "cvss_recall": 0.7588, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 521, "fp": 996, "fn": 182, "tn": 117, "precision": 0.3434, "recall": 0.7411, "f2_score": 60.2, "f3_score": 66.4, "cvss_precision": 0.3392, "cvss_recall": 0.7588, "cvss_f3_score": 67.5 }, "macro": { "f2_score": 61.6 }, "per_severity": { "critical": { "tp": 75, "fp": 2, "fn": 12 }, "high": { "tp": 197, "fp": 1, "fn": 68 }, "low": { "tp": 40, "fp": 0, "fn": 28 }, "medium": { "tp": 209, "fp": 1, "fn": 74 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 10.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 25.655, "successful_runs": 26, "cost_per_run": 0.9867, "total_loc_scanned": 20062, "cost_per_100_loc": 0.1279 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 445, "fp": 524, "fn": 258, "tn": 119, "precision": 0.4592, "recall": 0.633, "f2_score": 58.8, "f3_score": 61.0, "cvss_precision": 0.4615, "cvss_recall": 0.6545, "cvss_f3_score": 62.8 }, "strict_micro": { "tp": 445, "fp": 524, "fn": 258, "tn": 119, "precision": 0.4592, "recall": 0.633, "f2_score": 58.8, "f3_score": 61.0, "cvss_precision": 0.4615, "cvss_recall": 0.6545, "cvss_f3_score": 62.8 }, "macro": { "f2_score": 62.5 }, "per_severity": { "critical": { "tp": 71, "fp": 0, "fn": 16 }, "high": { "tp": 172, "fp": 2, "fn": 93 }, "low": { "tp": 31, "fp": 0, "fn": 37 }, "medium": { "tp": 171, "fp": 0, "fn": 112 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.4, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 3.9098, "successful_runs": 26, "cost_per_run": 0.1504, "total_loc_scanned": 20062, "cost_per_100_loc": 0.0195 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 125, "fp": 62, "fn": 578, "tn": 121, "precision": 0.6684, "recall": 0.1778, "f2_score": 20.8, "f3_score": 19.2, "cvss_precision": 0.6483, "cvss_recall": 0.2027, "cvss_f3_score": 21.8 }, "strict_micro": { "tp": 125, "fp": 62, "fn": 578, "tn": 121, "precision": 0.6684, "recall": 0.1778, "f2_score": 20.8, "f3_score": 19.2, "cvss_precision": 0.6483, "cvss_recall": 0.2027, "cvss_f3_score": 21.8 }, "macro": { "f2_score": 24.7 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 52 }, "high": { "tp": 53, "fp": 0, "fn": 212 }, "low": { "tp": 1, "fp": 0, "fn": 67 }, "medium": { "tp": 36, "fp": 0, "fn": 247 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 16.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 586, "fp": 1145, "fn": 117, "tn": 103, "precision": 0.3385, "recall": 0.8336, "f2_score": 64.5, "f3_score": 72.7, "cvss_precision": 0.3176, "cvss_recall": 0.8478, "cvss_f3_score": 72.7 }, "strict_micro": { "tp": 586, "fp": 1145, "fn": 117, "tn": 103, "precision": 0.3385, "recall": 0.8336, "f2_score": 64.5, "f3_score": 72.7, "cvss_precision": 0.3176, "cvss_recall": 0.8478, "cvss_f3_score": 72.7 }, "macro": { "f2_score": 66.4 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 227, "fp": 6, "fn": 38 }, "low": { "tp": 46, "fp": 1, "fn": 22 }, "medium": { "tp": 229, "fp": 6, "fn": 54 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 624, "fp": 243, "fn": 79, "tn": 119, "precision": 0.7197, "recall": 0.8876, "f2_score": 84.8, "f3_score": 86.7, "cvss_precision": 0.6979, "cvss_recall": 0.8883, "cvss_f3_score": 86.5 }, "strict_micro": { "tp": 624, "fp": 243, "fn": 79, "tn": 119, "precision": 0.7197, "recall": 0.8876, "f2_score": 84.8, "f3_score": 86.7, "cvss_precision": 0.6979, "cvss_recall": 0.8883, "cvss_f3_score": 86.5 }, "macro": { "f2_score": 85.0 }, "per_severity": { "critical": { "tp": 76, "fp": 1, "fn": 11 }, "high": { "tp": 243, "fp": 1, "fn": 22 }, "low": { "tp": 61, "fp": 0, "fn": 7 }, "medium": { "tp": 244, "fp": 0, "fn": 39 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 6.4, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 361, "fp": 296, "fn": 342, "tn": 120, "precision": 0.5495, "recall": 0.5135, "f2_score": 52.0, "f3_score": 51.7, "cvss_precision": 0.5427, "cvss_recall": 0.5414, "cvss_f3_score": 54.2 }, "strict_micro": { "tp": 361, "fp": 296, "fn": 342, "tn": 120, "precision": 0.5495, "recall": 0.5135, "f2_score": 52.0, "f3_score": 51.7, "cvss_precision": 0.5427, "cvss_recall": 0.5414, "cvss_f3_score": 54.2 }, "macro": { "f2_score": 56.1 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 21 }, "high": { "tp": 150, "fp": 1, "fn": 115 }, "low": { "tp": 21, "fp": 0, "fn": 47 }, "medium": { "tp": 124, "fp": 0, "fn": 159 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 17.7, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 595, "fp": 1344, "fn": 108, "tn": 103, "precision": 0.3069, "recall": 0.8464, "f2_score": 62.6, "f3_score": 72.0, "cvss_precision": 0.292, "cvss_recall": 0.8574, "cvss_f3_score": 71.8 }, "strict_micro": { "tp": 595, "fp": 1344, "fn": 108, "tn": 103, "precision": 0.3069, "recall": 0.8464, "f2_score": 62.6, "f3_score": 72.0, "cvss_precision": 0.292, "cvss_recall": 0.8574, "cvss_f3_score": 71.8 }, "macro": { "f2_score": 64.1 }, "per_severity": { "critical": { "tp": 84, "fp": 5, "fn": 3 }, "high": { "tp": 228, "fp": 6, "fn": 37 }, "low": { "tp": 50, "fp": 1, "fn": 18 }, "medium": { "tp": 233, "fp": 6, "fn": 50 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 9.2, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 276, "fp": 110, "fn": 427, "tn": 116, "precision": 0.715, "recall": 0.3926, "f2_score": 43.2, "f3_score": 41.1, "cvss_precision": 0.7684, "cvss_recall": 0.4311, "cvss_f3_score": 45.1 }, "strict_micro": { "tp": 276, "fp": 110, "fn": 427, "tn": 116, "precision": 0.715, "recall": 0.3926, "f2_score": 43.2, "f3_score": 41.1, "cvss_precision": 0.7684, "cvss_recall": 0.4311, "cvss_f3_score": 45.1 }, "macro": { "f2_score": 45.6 }, "per_severity": { "critical": { "tp": 67, "fp": 1, "fn": 20 }, "high": { "tp": 119, "fp": 4, "fn": 146 }, "low": { "tp": 10, "fp": 0, "fn": 58 }, "medium": { "tp": 89, "fp": 2, "fn": 194 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 13.0, "num_runs": 3, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 1.8883, "successful_runs": 63, "cost_per_run": 0.03, "total_loc_scanned": 18429, "cost_per_100_loc": 0.0049 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 193, "fp": 155, "fn": 381, "tn": 96, "precision": 0.5546, "recall": 0.3362, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6294, "cvss_recall": 0.3629, "cvss_f3_score": 37.9 }, "strict_micro": { "tp": 193, "fp": 155, "fn": 510, "tn": 114, "precision": 0.5546, "recall": 0.2745, "f2_score": 30.5, "f3_score": 28.9, "cvss_precision": 0.6294, "cvss_recall": 0.3003, "cvss_f3_score": 31.7 }, "macro": { "f2_score": 38.6 }, "per_severity": { "critical": { "tp": 46, "fp": 1, "fn": 33 }, "high": { "tp": 78, "fp": 3, "fn": 145 }, "low": { "tp": 9, "fp": 0, "fn": 41 }, "medium": { "tp": 60, "fp": 3, "fn": 162 } }, "repos_scored": 22, "repos_total": 26, "f2_stddev": 26.4, "num_runs": 1, "language_coverage": { "python": [ 22, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 22, "cost_per_run": 0.0, "total_loc_scanned": 16343, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 272, "fp": 132, "fn": 395, "tn": 108, "precision": 0.6733, "recall": 0.4078, "f2_score": 44.3, "f3_score": 42.5, "cvss_precision": 0.7478, "cvss_recall": 0.4426, "cvss_f3_score": 46.1 }, "strict_micro": { "tp": 272, "fp": 132, "fn": 431, "tn": 112, "precision": 0.6733, "recall": 0.3869, "f2_score": 42.3, "f3_score": 40.4, "cvss_precision": 0.7478, "cvss_recall": 0.4195, "cvss_f3_score": 43.9 }, "macro": { "f2_score": 52.1 }, "per_severity": { "critical": { "tp": 52, "fp": 1, "fn": 31 }, "high": { "tp": 120, "fp": 7, "fn": 131 }, "low": { "tp": 15, "fp": 1, "fn": 52 }, "medium": { "tp": 85, "fp": 0, "fn": 181 } }, "repos_scored": 25, "repos_total": 26, "f2_stddev": 21.1, "num_runs": 1, "language_coverage": { "python": [ 25, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 25, "cost_per_run": 0.0, "total_loc_scanned": 18055, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 148, "fp": 465, "fn": 520, "tn": 103, "precision": 0.2414, "recall": 0.2216, "f2_score": 22.5, "f3_score": 22.3, "cvss_precision": 0.4253, "cvss_recall": 0.2486, "cvss_f3_score": 25.9 }, "strict_micro": { "tp": 148, "fp": 465, "fn": 555, "tn": 110, "precision": 0.2414, "recall": 0.2105, "f2_score": 21.6, "f3_score": 21.3, "cvss_precision": 0.4253, "cvss_recall": 0.2348, "cvss_f3_score": 24.6 }, "macro": { "f2_score": 23.3 }, "per_severity": { "critical": { "tp": 51, "fp": 2, "fn": 31 }, "high": { "tp": 44, "fp": 7, "fn": 207 }, "low": { "tp": 6, "fp": 0, "fn": 60 }, "medium": { "tp": 47, "fp": 2, "fn": 222 } }, "repos_scored": 24, "repos_total": 26, "f2_stddev": 11.7, "num_runs": 1, "language_coverage": { "python": [ 24, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 134, "fp": 481, "fn": 569, "tn": 116, "precision": 0.2179, "recall": 0.1906, "f2_score": 19.6, "f3_score": 19.3, "cvss_precision": 0.2583, "cvss_recall": 0.2077, "cvss_f3_score": 21.2 }, "strict_micro": { "tp": 134, "fp": 481, "fn": 569, "tn": 116, "precision": 0.2179, "recall": 0.1906, "f2_score": 19.6, "f3_score": 19.3, "cvss_precision": 0.2583, "cvss_recall": 0.2077, "cvss_f3_score": 21.2 }, "macro": { "f2_score": 19.6 }, "per_severity": { "critical": { "tp": 41, "fp": 0, "fn": 46 }, "high": { "tp": 44, "fp": 4, "fn": 221 }, "low": { "tp": 3, "fp": 0, "fn": 65 }, "medium": { "tp": 46, "fp": 1, "fn": 237 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 14.9, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 44, "fp": 28, "fn": 659, "tn": 120, "precision": 0.6111, "recall": 0.0626, "f2_score": 7.6, "f3_score": 6.9, "cvss_precision": 0.5584, "cvss_recall": 0.0705, "cvss_f3_score": 7.7 }, "strict_micro": { "tp": 44, "fp": 28, "fn": 659, "tn": 120, "precision": 0.6111, "recall": 0.0626, "f2_score": 7.6, "f3_score": 6.9, "cvss_precision": 0.5584, "cvss_recall": 0.0705, "cvss_f3_score": 7.7 }, "macro": { "f2_score": 6.4 }, "per_severity": { "critical": { "tp": 10, "fp": 0, "fn": 77 }, "high": { "tp": 14, "fp": 0, "fn": 251 }, "low": { "tp": 0, "fp": 0, "fn": 68 }, "medium": { "tp": 20, "fp": 1, "fn": 263 } }, "repos_scored": 26, "repos_total": 26, "f2_stddev": 11.6, "num_runs": 1, "language_coverage": { "python": [ 26, 26 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "tsjs:intentional": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 181, "fp": 319, "fn": 354, "tn": 0, "precision": 0.362, "recall": 0.3383, "f2_score": 34.3, "f3_score": 34.1, "cvss_precision": 0.4108, "cvss_recall": 0.3679, "cvss_f3_score": 37.2 }, "strict_micro": { "tp": 181, "fp": 319, "fn": 354, "tn": 0, "precision": 0.362, "recall": 0.3383, "f2_score": 34.3, "f3_score": 34.1, "cvss_precision": 0.4108, "cvss_recall": 0.3679, "cvss_f3_score": 37.2 }, "macro": { "f2_score": 39.3 }, "per_severity": { "high": { "tp": 178, "fp": 0, "fn": 273 }, "medium": { "tp": 2, "fp": 0, "fn": 13 }, "low": { "tp": 1, "fp": 0, "fn": 68 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 20.8, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 13.2805, "successful_runs": 24, "cost_per_run": 0.5534, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0099 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 154, "fp": 281, "fn": 381, "tn": 0, "precision": 0.354, "recall": 0.2879, "f2_score": 29.9, "f3_score": 29.3, "cvss_precision": 0.4002, "cvss_recall": 0.3141, "cvss_f3_score": 32.1 }, "strict_micro": { "tp": 154, "fp": 281, "fn": 381, "tn": 0, "precision": 0.354, "recall": 0.2879, "f2_score": 29.9, "f3_score": 29.3, "cvss_precision": 0.4002, "cvss_recall": 0.3141, "cvss_f3_score": 32.1 }, "macro": { "f2_score": 38.5 }, "per_severity": { "high": { "tp": 149, "fp": 0, "fn": 302 }, "medium": { "tp": 2, "fp": 0, "fn": 13 }, "low": { "tp": 3, "fp": 0, "fn": 66 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 25.8, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.4106, "successful_runs": 24, "cost_per_run": 0.0171, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0003 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 161, "fp": 230, "fn": 374, "tn": 0, "precision": 0.4118, "recall": 0.3009, "f2_score": 31.8, "f3_score": 30.9, "cvss_precision": 0.4617, "cvss_recall": 0.3299, "cvss_f3_score": 34.0 }, "strict_micro": { "tp": 161, "fp": 230, "fn": 374, "tn": 0, "precision": 0.4118, "recall": 0.3009, "f2_score": 31.8, "f3_score": 30.9, "cvss_precision": 0.4617, "cvss_recall": 0.3299, "cvss_f3_score": 34.0 }, "macro": { "f2_score": 37.2 }, "per_severity": { "high": { "tp": 157, "fp": 0, "fn": 294 }, "medium": { "tp": 2, "fp": 0, "fn": 13 }, "low": { "tp": 2, "fp": 0, "fn": 67 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 21.8, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.8492, "successful_runs": 24, "cost_per_run": 0.0354, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0006 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 193, "fp": 322, "fn": 342, "tn": 0, "precision": 0.3748, "recall": 0.3607, "f2_score": 36.3, "f3_score": 36.2, "cvss_precision": 0.4059, "cvss_recall": 0.3846, "cvss_f3_score": 38.7 }, "strict_micro": { "tp": 193, "fp": 322, "fn": 342, "tn": 0, "precision": 0.3748, "recall": 0.3607, "f2_score": 36.3, "f3_score": 36.2, "cvss_precision": 0.4059, "cvss_recall": 0.3846, "cvss_f3_score": 38.7 }, "macro": { "f2_score": 42.8 }, "per_severity": { "high": { "tp": 190, "fp": 0, "fn": 261 }, "medium": { "tp": 0, "fp": 0, "fn": 15 }, "low": { "tp": 3, "fp": 0, "fn": 66 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 23.6, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 24, "cost_per_run": 0.0, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 226, "fp": 482, "fn": 232, "tn": 0, "precision": 0.3192, "recall": 0.4934, "f2_score": 44.5, "f3_score": 46.8, "cvss_precision": 0.3567, "cvss_recall": 0.5191, "cvss_f3_score": 49.6 }, "strict_micro": { "tp": 226, "fp": 482, "fn": 309, "tn": 0, "precision": 0.3192, "recall": 0.4224, "f2_score": 39.7, "f3_score": 40.9, "cvss_precision": 0.3567, "cvss_recall": 0.4478, "cvss_f3_score": 43.7 }, "macro": { "f2_score": 48.3 }, "per_severity": { "high": { "tp": 216, "fp": 0, "fn": 182 }, "medium": { "tp": 3, "fp": 0, "fn": 10 }, "low": { "tp": 7, "fp": 0, "fn": 40 } }, "repos_scored": 23, "repos_total": 24, "f2_stddev": 21.1, "num_runs": 1, "language_coverage": { "tsjs": [ 23, 24 ] }, "cost": { "total_cost": 12.0662, "successful_runs": 23, "cost_per_run": 0.5246, "total_loc_scanned": 132161, "cost_per_100_loc": 0.0091 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 397, "fp": 356, "fn": 138, "tn": 0, "precision": 0.5272, "recall": 0.7421, "f2_score": 68.6, "f3_score": 71.3, "cvss_precision": 0.5341, "cvss_recall": 0.7383, "cvss_f3_score": 71.1 }, "strict_micro": { "tp": 397, "fp": 356, "fn": 138, "tn": 0, "precision": 0.5272, "recall": 0.7421, "f2_score": 68.6, "f3_score": 71.3, "cvss_precision": 0.5341, "cvss_recall": 0.7383, "cvss_f3_score": 71.1 }, "macro": { "f2_score": 68.3 }, "per_severity": { "high": { "tp": 339, "fp": 0, "fn": 112 }, "medium": { "tp": 5, "fp": 0, "fn": 10 }, "low": { "tp": 53, "fp": 0, "fn": 16 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 22.8, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 65.6254, "successful_runs": 24, "cost_per_run": 2.7344, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0487 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 252, "fp": 440, "fn": 283, "tn": 0, "precision": 0.3642, "recall": 0.471, "f2_score": 44.5, "f3_score": 45.8, "cvss_precision": 0.3873, "cvss_recall": 0.5011, "cvss_f3_score": 48.7 }, "strict_micro": { "tp": 252, "fp": 440, "fn": 283, "tn": 0, "precision": 0.3642, "recall": 0.471, "f2_score": 44.5, "f3_score": 45.8, "cvss_precision": 0.3873, "cvss_recall": 0.5011, "cvss_f3_score": 48.7 }, "macro": { "f2_score": 50.5 }, "per_severity": { "high": { "tp": 242, "fp": 0, "fn": 209 }, "medium": { "tp": 5, "fp": 0, "fn": 10 }, "low": { "tp": 5, "fp": 0, "fn": 64 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 20.6, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 138.7821, "successful_runs": 24, "cost_per_run": 5.7826, "total_loc_scanned": 134669, "cost_per_100_loc": 0.1031 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 454, "fp": 307, "fn": 81, "tn": 0, "precision": 0.5966, "recall": 0.8486, "f2_score": 78.2, "f3_score": 81.4, "cvss_precision": 0.6045, "cvss_recall": 0.842, "cvss_f3_score": 81.0 }, "strict_micro": { "tp": 454, "fp": 307, "fn": 81, "tn": 0, "precision": 0.5966, "recall": 0.8486, "f2_score": 78.2, "f3_score": 81.4, "cvss_precision": 0.6045, "cvss_recall": 0.842, "cvss_f3_score": 81.0 }, "macro": { "f2_score": 74.8 }, "per_severity": { "high": { "tp": 380, "fp": 0, "fn": 71 }, "medium": { "tp": 12, "fp": 0, "fn": 3 }, "low": { "tp": 62, "fp": 0, "fn": 7 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 20.6, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 65.2079, "successful_runs": 24, "cost_per_run": 2.717, "total_loc_scanned": 134669, "cost_per_100_loc": 0.0484 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 465, "fp": 597, "fn": 70, "tn": 0, "precision": 0.4379, "recall": 0.8692, "f2_score": 72.6, "f3_score": 79.1, "cvss_precision": 0.3968, "cvss_recall": 0.8615, "cvss_f3_score": 77.1 }, "strict_micro": { "tp": 465, "fp": 597, "fn": 70, "tn": 0, "precision": 0.4379, "recall": 0.8692, "f2_score": 72.6, "f3_score": 79.1, "cvss_precision": 0.3968, "cvss_recall": 0.8615, "cvss_f3_score": 77.1 }, "macro": { "f2_score": 72.4 }, "per_severity": { "high": { "tp": 387, "fp": 0, "fn": 64 }, "medium": { "tp": 12, "fp": 0, "fn": 3 }, "low": { "tp": 66, "fp": 0, "fn": 3 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 15.0, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 86, "fp": 963, "fn": 449, "tn": 0, "precision": 0.082, "recall": 0.1607, "f2_score": 13.5, "f3_score": 14.7, "cvss_precision": 0.0975, "cvss_recall": 0.1823, "cvss_f3_score": 16.8 }, "strict_micro": { "tp": 86, "fp": 963, "fn": 449, "tn": 0, "precision": 0.082, "recall": 0.1607, "f2_score": 13.5, "f3_score": 14.7, "cvss_precision": 0.0975, "cvss_recall": 0.1823, "cvss_f3_score": 16.8 }, "macro": { "f2_score": 13.8 }, "per_severity": { "high": { "tp": 85, "fp": 0, "fn": 366 }, "medium": { "tp": 1, "fp": 0, "fn": 14 }, "low": { "tp": 0, "fp": 0, "fn": 69 } }, "repos_scored": 24, "repos_total": 24, "f2_stddev": 14.8, "num_runs": 1, "language_coverage": { "tsjs": [ 24, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 535, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 24, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 24 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "vibe": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 814, "fp": 468, "fn": 385, "tn": 157, "precision": 0.6349, "recall": 0.6789, "f2_score": 67.0, "f3_score": 67.4, "cvss_precision": 0.6821, "cvss_recall": 0.6912, "cvss_f3_score": 69.0 }, "strict_micro": { "tp": 814, "fp": 468, "fn": 2086, "tn": 157, "precision": 0.6349, "recall": 0.2807, "f2_score": 31.6, "f3_score": 29.7, "cvss_precision": 0.6821, "cvss_recall": 0.2705, "cvss_f3_score": 28.8 }, "macro": { "f2_score": 67.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 337, "fp": 1, "fn": 150 }, "medium": { "tp": 394, "fp": 1, "fn": 233 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 9.9, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 66.1096, "successful_runs": 40, "cost_per_run": 1.6527, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0581 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 1242, "fp": 1119, "fn": 1658, "tn": 157, "precision": 0.526, "recall": 0.4283, "f2_score": 44.5, "f3_score": 43.6, "cvss_precision": 0.5683, "cvss_recall": 0.4455, "cvss_f3_score": 45.5 }, "strict_micro": { "tp": 1242, "fp": 1119, "fn": 1658, "tn": 157, "precision": 0.526, "recall": 0.4283, "f2_score": 44.5, "f3_score": 43.6, "cvss_precision": 0.5683, "cvss_recall": 0.4455, "cvss_f3_score": 45.5 }, "macro": { "f2_score": 44.6 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 5 }, "high": { "tp": 866, "fp": 0, "fn": 1266 }, "medium": { "tp": 292, "fp": 2, "fn": 376 }, "low": { "tp": 18, "fp": 0, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 15.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 108.0662, "successful_runs": 90, "cost_per_run": 1.2007, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0184 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 1144, "fp": 900, "fn": 1756, "tn": 154, "precision": 0.5597, "recall": 0.3945, "f2_score": 41.9, "f3_score": 40.6, "cvss_precision": 0.605, "cvss_recall": 0.4153, "cvss_f3_score": 42.9 }, "strict_micro": { "tp": 1144, "fp": 900, "fn": 1756, "tn": 154, "precision": 0.5597, "recall": 0.3945, "f2_score": 41.9, "f3_score": 40.6, "cvss_precision": 0.605, "cvss_recall": 0.4153, "cvss_f3_score": 42.9 }, "macro": { "f2_score": 42.4 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 809, "fp": 0, "fn": 1323 }, "medium": { "tp": 249, "fp": 3, "fn": 419 }, "low": { "tp": 18, "fp": 2, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 12.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 2.4599, "successful_runs": 90, "cost_per_run": 0.0273, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0004 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 990, "fp": 642, "fn": 1910, "tn": 158, "precision": 0.6066, "recall": 0.3414, "f2_score": 37.4, "f3_score": 35.7, "cvss_precision": 0.6681, "cvss_recall": 0.3565, "cvss_f3_score": 37.4 }, "strict_micro": { "tp": 990, "fp": 642, "fn": 1910, "tn": 158, "precision": 0.6066, "recall": 0.3414, "f2_score": 37.4, "f3_score": 35.7, "cvss_precision": 0.6681, "cvss_recall": 0.3565, "cvss_f3_score": 37.4 }, "macro": { "f2_score": 36.9 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 667, "fp": 0, "fn": 1465 }, "medium": { "tp": 238, "fp": 1, "fn": 430 }, "low": { "tp": 17, "fp": 0, "fn": 12 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 19.8, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 4.6427, "successful_runs": 90, "cost_per_run": 0.0516, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0008 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 1472, "fp": 1408, "fn": 1428, "tn": 154, "precision": 0.5111, "recall": 0.5076, "f2_score": 50.8, "f3_score": 50.8, "cvss_precision": 0.534, "cvss_recall": 0.5185, "cvss_f3_score": 52.0 }, "strict_micro": { "tp": 1472, "fp": 1408, "fn": 1428, "tn": 154, "precision": 0.5111, "recall": 0.5076, "f2_score": 50.8, "f3_score": 50.8, "cvss_precision": 0.534, "cvss_recall": 0.5185, "cvss_f3_score": 52.0 }, "macro": { "f2_score": 51.0 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 6 }, "high": { "tp": 1070, "fp": 0, "fn": 1062 }, "medium": { "tp": 318, "fp": 5, "fn": 350 }, "low": { "tp": 19, "fp": 0, "fn": 10 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 13.7, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 90, "cost_per_run": 0.0, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 387, "fp": 30, "fn": 783, "tn": 155, "precision": 0.9281, "recall": 0.3308, "f2_score": 38.0, "f3_score": 35.4, "cvss_precision": 0.9387, "cvss_recall": 0.3594, "cvss_f3_score": 38.3 }, "strict_micro": { "tp": 387, "fp": 30, "fn": 2514, "tn": 159, "precision": 0.9281, "recall": 0.1334, "f2_score": 16.1, "f3_score": 14.6, "cvss_precision": 0.9387, "cvss_recall": 0.137, "cvss_f3_score": 15.0 }, "macro": { "f2_score": 38.1 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 3 }, "high": { "tp": 184, "fp": 0, "fn": 292 }, "medium": { "tp": 143, "fp": 1, "fn": 466 }, "low": { "tp": 2, "fp": 0, "fn": 16 } }, "repos_scored": 39, "repos_total": 90, "f2_stddev": 7.1, "num_runs": 3, "language_coverage": { "python": [ 39, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 60.5806, "successful_runs": 90, "cost_per_run": 0.6731, "total_loc_scanned": 111246, "cost_per_100_loc": 0.0232 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 262, "fp": 27, "fn": 937, "tn": 159, "precision": 0.9066, "recall": 0.2185, "f2_score": 25.8, "f3_score": 23.6, "cvss_precision": 0.9624, "cvss_recall": 0.2481, "cvss_f3_score": 26.8 }, "strict_micro": { "tp": 262, "fp": 27, "fn": 2638, "tn": 159, "precision": 0.9066, "recall": 0.0903, "f2_score": 11.0, "f3_score": 9.9, "cvss_precision": 0.9624, "cvss_recall": 0.0971, "cvss_f3_score": 10.7 }, "macro": { "f2_score": 25.1 }, "per_severity": { "critical": { "tp": 46, "fp": 0, "fn": 21 }, "high": { "tp": 134, "fp": 0, "fn": 353 }, "medium": { "tp": 78, "fp": 0, "fn": 549 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 17.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 40, "cost_per_run": 0.0, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 366, "fp": 78, "fn": 833, "tn": 159, "precision": 0.8243, "recall": 0.3053, "f2_score": 34.9, "f3_score": 32.6, "cvss_precision": 0.8773, "cvss_recall": 0.3162, "cvss_f3_score": 33.8 }, "strict_micro": { "tp": 366, "fp": 78, "fn": 2534, "tn": 159, "precision": 0.8243, "recall": 0.1262, "f2_score": 15.2, "f3_score": 13.8, "cvss_precision": 0.8773, "cvss_recall": 0.1237, "cvss_f3_score": 13.5 }, "macro": { "f2_score": 33.7 }, "per_severity": { "critical": { "tp": 44, "fp": 0, "fn": 23 }, "high": { "tp": 152, "fp": 0, "fn": 335 }, "medium": { "tp": 165, "fp": 1, "fn": 462 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 22.9, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 9.2202, "successful_runs": 120, "cost_per_run": 0.0768, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0027 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 461, "fp": 179, "fn": 738, "tn": 159, "precision": 0.7203, "recall": 0.3845, "f2_score": 42.4, "f3_score": 40.3, "cvss_precision": 0.8025, "cvss_recall": 0.3968, "cvss_f3_score": 41.8 }, "strict_micro": { "tp": 461, "fp": 179, "fn": 2439, "tn": 159, "precision": 0.7203, "recall": 0.159, "f2_score": 18.8, "f3_score": 17.2, "cvss_precision": 0.8025, "cvss_recall": 0.1553, "cvss_f3_score": 16.9 }, "macro": { "f2_score": 40.5 }, "per_severity": { "critical": { "tp": 49, "fp": 0, "fn": 18 }, "high": { "tp": 200, "fp": 0, "fn": 287 }, "medium": { "tp": 207, "fp": 0, "fn": 420 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 26.4, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 22.052, "successful_runs": 120, "cost_per_run": 0.1838, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0065 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 448, "fp": 270, "fn": 751, "tn": 159, "precision": 0.624, "recall": 0.3736, "f2_score": 40.6, "f3_score": 38.9, "cvss_precision": 0.7499, "cvss_recall": 0.3871, "cvss_f3_score": 40.7 }, "strict_micro": { "tp": 448, "fp": 270, "fn": 2452, "tn": 159, "precision": 0.624, "recall": 0.1545, "f2_score": 18.2, "f3_score": 16.7, "cvss_precision": 0.7499, "cvss_recall": 0.1515, "cvss_f3_score": 16.5 }, "macro": { "f2_score": 38.2 }, "per_severity": { "critical": { "tp": 43, "fp": 0, "fn": 24 }, "high": { "tp": 187, "fp": 0, "fn": 300 }, "medium": { "tp": 195, "fp": 0, "fn": 432 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 26.6, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 17.3582, "successful_runs": 120, "cost_per_run": 0.1447, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0051 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 1631, "fp": 2076, "fn": 1152, "tn": 154, "precision": 0.44, "recall": 0.5861, "f2_score": 55.0, "f3_score": 56.7, "cvss_precision": 0.4802, "cvss_recall": 0.6013, "cvss_f3_score": 58.7 }, "strict_micro": { "tp": 1631, "fp": 2076, "fn": 1269, "tn": 154, "precision": 0.44, "recall": 0.5624, "f2_score": 53.3, "f3_score": 54.7, "cvss_precision": 0.4802, "cvss_recall": 0.5761, "cvss_f3_score": 56.5 }, "macro": { "f2_score": 55.2 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 4 }, "high": { "tp": 1192, "fp": 0, "fn": 827 }, "medium": { "tp": 354, "fp": 5, "fn": 312 }, "low": { "tp": 20, "fp": 0, "fn": 9 } }, "repos_scored": 87, "repos_total": 90, "f2_stddev": 10.2, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 47, 50 ] }, "cost": { "total_cost": 82.8238, "successful_runs": 87, "cost_per_run": 0.952, "total_loc_scanned": 561506, "cost_per_100_loc": 0.0148 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 643, "fp": 320, "fn": 556, "tn": 159, "precision": 0.6677, "recall": 0.5363, "f2_score": 55.8, "f3_score": 54.7, "cvss_precision": 0.7704, "cvss_recall": 0.5727, "cvss_f3_score": 58.8 }, "strict_micro": { "tp": 643, "fp": 320, "fn": 2257, "tn": 159, "precision": 0.6677, "recall": 0.2217, "f2_score": 25.6, "f3_score": 23.8, "cvss_precision": 0.7704, "cvss_recall": 0.2241, "cvss_f3_score": 24.1 }, "macro": { "f2_score": 55.8 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 293, "fp": 0, "fn": 194 }, "medium": { "tp": 259, "fp": 1, "fn": 368 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.6, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 77.6882, "successful_runs": 120, "cost_per_run": 0.6474, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0228 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 505, "fp": 130, "fn": 694, "tn": 157, "precision": 0.7953, "recall": 0.4212, "f2_score": 46.5, "f3_score": 44.2, "cvss_precision": 0.8642, "cvss_recall": 0.4497, "cvss_f3_score": 47.2 }, "strict_micro": { "tp": 505, "fp": 130, "fn": 2395, "tn": 157, "precision": 0.7953, "recall": 0.1741, "f2_score": 20.6, "f3_score": 18.9, "cvss_precision": 0.8642, "cvss_recall": 0.176, "cvss_f3_score": 19.1 }, "macro": { "f2_score": 46.5 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 4 }, "high": { "tp": 221, "fp": 0, "fn": 266 }, "medium": { "tp": 209, "fp": 2, "fn": 418 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 12.6, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.7536, "successful_runs": 40, "cost_per_run": 0.0188, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0007 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 2320, "fp": 1631, "fn": 580, "tn": 157, "precision": 0.5872, "recall": 0.8, "f2_score": 74.6, "f3_score": 77.2, "cvss_precision": 0.6018, "cvss_recall": 0.806, "cvss_f3_score": 78.0 }, "strict_micro": { "tp": 2320, "fp": 1631, "fn": 580, "tn": 157, "precision": 0.5872, "recall": 0.8, "f2_score": 74.6, "f3_score": 77.2, "cvss_precision": 0.6018, "cvss_recall": 0.806, "cvss_f3_score": 78.0 }, "macro": { "f2_score": 74.3 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 1677, "fp": 1, "fn": 455 }, "medium": { "tp": 550, "fp": 1, "fn": 118 }, "low": { "tp": 25, "fp": 0, "fn": 4 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 21.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 441.1759, "successful_runs": 90, "cost_per_run": 4.902, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0752 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 561, "fp": 212, "fn": 638, "tn": 158, "precision": 0.7257, "recall": 0.4679, "f2_score": 50.4, "f3_score": 48.5, "cvss_precision": 0.7918, "cvss_recall": 0.5103, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 561, "fp": 212, "fn": 2339, "tn": 158, "precision": 0.7257, "recall": 0.1934, "f2_score": 22.7, "f3_score": 20.9, "cvss_precision": 0.7918, "cvss_recall": 0.1997, "cvss_f3_score": 21.6 }, "macro": { "f2_score": 50.5 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 277, "fp": 0, "fn": 210 }, "medium": { "tp": 203, "fp": 1, "fn": 424 }, "low": { "tp": 16, "fp": 0, "fn": 2 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 10.2, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 22.3235, "successful_runs": 40, "cost_per_run": 0.5581, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0196 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 1571, "fp": 2053, "fn": 1329, "tn": 156, "precision": 0.4335, "recall": 0.5417, "f2_score": 51.6, "f3_score": 52.9, "cvss_precision": 0.4567, "cvss_recall": 0.5722, "cvss_f3_score": 55.8 }, "strict_micro": { "tp": 1571, "fp": 2053, "fn": 1329, "tn": 156, "precision": 0.4335, "recall": 0.5417, "f2_score": 51.6, "f3_score": 52.9, "cvss_precision": 0.4567, "cvss_recall": 0.5722, "cvss_f3_score": 55.8 }, "macro": { "f2_score": 50.6 }, "per_severity": { "critical": { "tp": 61, "fp": 0, "fn": 10 }, "high": { "tp": 1273, "fp": 1, "fn": 859 }, "medium": { "tp": 219, "fp": 2, "fn": 449 }, "low": { "tp": 18, "fp": 0, "fn": 11 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 9.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 837.6247, "successful_runs": 90, "cost_per_run": 9.3069, "total_loc_scanned": 586303, "cost_per_100_loc": 0.1429 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 2474, "fp": 1412, "fn": 426, "tn": 158, "precision": 0.6366, "recall": 0.8531, "f2_score": 79.9, "f3_score": 82.5, "cvss_precision": 0.6486, "cvss_recall": 0.8541, "cvss_f3_score": 82.8 }, "strict_micro": { "tp": 2474, "fp": 1412, "fn": 426, "tn": 158, "precision": 0.6366, "recall": 0.8531, "f2_score": 79.9, "f3_score": 82.5, "cvss_precision": 0.6486, "cvss_recall": 0.8541, "cvss_f3_score": 82.8 }, "macro": { "f2_score": 79.7 }, "per_severity": { "critical": { "tp": 68, "fp": 0, "fn": 3 }, "high": { "tp": 1793, "fp": 0, "fn": 339 }, "medium": { "tp": 588, "fp": 1, "fn": 80 }, "low": { "tp": 25, "fp": 0, "fn": 4 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 18.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 427.3403, "successful_runs": 90, "cost_per_run": 4.7482, "total_loc_scanned": 586303, "cost_per_100_loc": 0.0729 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 499, "fp": 165, "fn": 699, "tn": 157, "precision": 0.7515, "recall": 0.4165, "f2_score": 45.7, "f3_score": 43.6, "cvss_precision": 0.8295, "cvss_recall": 0.4336, "cvss_f3_score": 45.5 }, "strict_micro": { "tp": 499, "fp": 165, "fn": 2400, "tn": 157, "precision": 0.7515, "recall": 0.1721, "f2_score": 20.4, "f3_score": 18.7, "cvss_precision": 0.8295, "cvss_recall": 0.1697, "cvss_f3_score": 18.4 }, "macro": { "f2_score": 45.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 206, "fp": 1, "fn": 281 }, "medium": { "tp": 217, "fp": 2, "fn": 410 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.1, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 5.7125, "successful_runs": 116, "cost_per_run": 0.0492, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0018 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 519, "fp": 210, "fn": 681, "tn": 159, "precision": 0.7119, "recall": 0.4325, "f2_score": 46.9, "f3_score": 45.0, "cvss_precision": 0.8217, "cvss_recall": 0.4574, "cvss_f3_score": 47.9 }, "strict_micro": { "tp": 519, "fp": 210, "fn": 2382, "tn": 159, "precision": 0.7119, "recall": 0.1789, "f2_score": 21.0, "f3_score": 19.3, "cvss_precision": 0.8217, "cvss_recall": 0.179, "cvss_f3_score": 19.4 }, "macro": { "f2_score": 46.8 }, "per_severity": { "critical": { "tp": 61, "fp": 0, "fn": 6 }, "high": { "tp": 222, "fp": 0, "fn": 265 }, "medium": { "tp": 209, "fp": 0, "fn": 418 }, "low": { "tp": 17, "fp": 0, "fn": 1 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 10.5, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 14.5495, "successful_runs": 92, "cost_per_run": 0.1581, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0052 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 580, "fp": 290, "fn": 618, "tn": 158, "precision": 0.6667, "recall": 0.4841, "f2_score": 51.2, "f3_score": 49.8, "cvss_precision": 0.8087, "cvss_recall": 0.5151, "cvss_f3_score": 53.4 }, "strict_micro": { "tp": 580, "fp": 290, "fn": 2319, "tn": 158, "precision": 0.6667, "recall": 0.2001, "f2_score": 23.3, "f3_score": 21.5, "cvss_precision": 0.8087, "cvss_recall": 0.2015, "cvss_f3_score": 21.8 }, "macro": { "f2_score": 51.2 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 1 }, "high": { "tp": 248, "fp": 0, "fn": 239 }, "medium": { "tp": 248, "fp": 3, "fn": 379 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.3, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 17.4576, "successful_runs": 109, "cost_per_run": 0.1602, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0057 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 709, "fp": 316, "fn": 490, "tn": 158, "precision": 0.6917, "recall": 0.5913, "f2_score": 60.9, "f3_score": 60.0, "cvss_precision": 0.81, "cvss_recall": 0.6103, "cvss_f3_score": 62.6 }, "strict_micro": { "tp": 709, "fp": 316, "fn": 2191, "tn": 158, "precision": 0.6917, "recall": 0.2445, "f2_score": 28.1, "f3_score": 26.1, "cvss_precision": 0.81, "cvss_recall": 0.2388, "cvss_f3_score": 25.7 }, "macro": { "f2_score": 61.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 310, "fp": 0, "fn": 177 }, "medium": { "tp": 316, "fp": 1, "fn": 311 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 9.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 15.5822, "successful_runs": 40, "cost_per_run": 0.3896, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0137 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 574, "fp": 310, "fn": 625, "tn": 145, "precision": 0.6493, "recall": 0.4787, "f2_score": 50.5, "f3_score": 49.2, "cvss_precision": 0.6666, "cvss_recall": 0.5024, "cvss_f3_score": 51.5 }, "strict_micro": { "tp": 574, "fp": 310, "fn": 2326, "tn": 145, "precision": 0.6493, "recall": 0.1979, "f2_score": 23.0, "f3_score": 21.3, "cvss_precision": 0.6666, "cvss_recall": 0.1966, "cvss_f3_score": 21.2 }, "macro": { "f2_score": 50.1 }, "per_severity": { "critical": { "tp": 57, "fp": 0, "fn": 10 }, "high": { "tp": 265, "fp": 1, "fn": 222 }, "medium": { "tp": 244, "fp": 13, "fn": 383 }, "low": { "tp": 8, "fp": 0, "fn": 10 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 18.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 217.937, "successful_runs": 40, "cost_per_run": 5.4484, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1916 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 945, "fp": 2130, "fn": 254, "tn": 144, "precision": 0.3073, "recall": 0.7882, "f2_score": 60.0, "f3_score": 68.2, "cvss_precision": 0.2823, "cvss_recall": 0.7986, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 945, "fp": 2130, "fn": 1955, "tn": 144, "precision": 0.3073, "recall": 0.3259, "f2_score": 32.2, "f3_score": 32.4, "cvss_precision": 0.2823, "cvss_recall": 0.3125, "cvss_f3_score": 30.9 }, "macro": { "f2_score": 59.8 }, "per_severity": { "critical": { "tp": 64, "fp": 0, "fn": 3 }, "high": { "tp": 379, "fp": 7, "fn": 108 }, "medium": { "tp": 484, "fp": 7, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.6, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 120.345, "successful_runs": 40, "cost_per_run": 3.0086, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1058 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 865, "fp": 1144, "fn": 334, "tn": 148, "precision": 0.4306, "recall": 0.7214, "f2_score": 63.6, "f3_score": 67.6, "cvss_precision": 0.3979, "cvss_recall": 0.7412, "cvss_f3_score": 68.2 }, "strict_micro": { "tp": 865, "fp": 1144, "fn": 2035, "tn": 148, "precision": 0.4306, "recall": 0.2983, "f2_score": 31.8, "f3_score": 30.8, "cvss_precision": 0.3979, "cvss_recall": 0.29, "cvss_f3_score": 29.8 }, "macro": { "f2_score": 63.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 357, "fp": 5, "fn": 130 }, "medium": { "tp": 427, "fp": 5, "fn": 200 }, "low": { "tp": 14, "fp": 1, "fn": 4 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 8.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 18.3403, "successful_runs": 40, "cost_per_run": 0.4585, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0161 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 110, "fp": 58, "fn": 1089, "tn": 158, "precision": 0.6548, "recall": 0.0917, "f2_score": 11.1, "f3_score": 10.0, "cvss_precision": 0.6362, "cvss_recall": 0.1049, "cvss_f3_score": 11.4 }, "strict_micro": { "tp": 110, "fp": 58, "fn": 2790, "tn": 158, "precision": 0.6548, "recall": 0.0379, "f2_score": 4.7, "f3_score": 4.2, "cvss_precision": 0.6362, "cvss_recall": 0.041, "cvss_f3_score": 4.5 }, "macro": { "f2_score": 10.8 }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 66 }, "high": { "tp": 76, "fp": 1, "fn": 411 }, "medium": { "tp": 30, "fp": 0, "fn": 597 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 939, "fp": 2035, "fn": 260, "tn": 144, "precision": 0.3157, "recall": 0.7832, "f2_score": 60.4, "f3_score": 68.2, "cvss_precision": 0.2826, "cvss_recall": 0.7921, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 939, "fp": 2035, "fn": 1961, "tn": 144, "precision": 0.3157, "recall": 0.3238, "f2_score": 32.2, "f3_score": 32.3, "cvss_precision": 0.2826, "cvss_recall": 0.3099, "cvss_f3_score": 30.7 }, "macro": { "f2_score": 60.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 381, "fp": 4, "fn": 106 }, "medium": { "tp": 473, "fp": 10, "fn": 154 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 6.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 2644, "fp": 2437, "fn": 256, "tn": 151, "precision": 0.5204, "recall": 0.9117, "f2_score": 79.3, "f3_score": 84.8, "cvss_precision": 0.4699, "cvss_recall": 0.9148, "cvss_f3_score": 83.6 }, "strict_micro": { "tp": 2644, "fp": 2437, "fn": 256, "tn": 151, "precision": 0.5204, "recall": 0.9117, "f2_score": 79.3, "f3_score": 84.8, "cvss_precision": 0.4699, "cvss_recall": 0.9148, "cvss_f3_score": 83.6 }, "macro": { "f2_score": 79.4 }, "per_severity": { "critical": { "tp": 69, "fp": 0, "fn": 2 }, "high": { "tp": 1956, "fp": 3, "fn": 176 }, "medium": { "tp": 600, "fp": 5, "fn": 68 }, "low": { "tp": 19, "fp": 0, "fn": 10 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 8.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 625, "fp": 819, "fn": 574, "tn": 157, "precision": 0.4328, "recall": 0.5213, "f2_score": 50.1, "f3_score": 51.1, "cvss_precision": 0.4364, "cvss_recall": 0.5452, "cvss_f3_score": 53.2 }, "strict_micro": { "tp": 625, "fp": 819, "fn": 2275, "tn": 157, "precision": 0.4328, "recall": 0.2155, "f2_score": 24.0, "f3_score": 22.7, "cvss_precision": 0.4364, "cvss_recall": 0.2134, "cvss_f3_score": 22.5 }, "macro": { "f2_score": 49.3 }, "per_severity": { "critical": { "tp": 53, "fp": 0, "fn": 14 }, "high": { "tp": 257, "fp": 1, "fn": 230 }, "medium": { "tp": 303, "fp": 1, "fn": 324 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 13.7, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 954, "fp": 2945, "fn": 245, "tn": 144, "precision": 0.2447, "recall": 0.7957, "f2_score": 54.9, "f3_score": 64.9, "cvss_precision": 0.2244, "cvss_recall": 0.8055, "cvss_f3_score": 64.0 }, "strict_micro": { "tp": 954, "fp": 2945, "fn": 1946, "tn": 144, "precision": 0.2447, "recall": 0.329, "f2_score": 30.8, "f3_score": 31.8, "cvss_precision": 0.2244, "cvss_recall": 0.3152, "cvss_f3_score": 30.3 }, "macro": { "f2_score": 55.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 385, "fp": 4, "fn": 102 }, "medium": { "tp": 484, "fp": 10, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 256, "fp": 184, "fn": 800, "tn": 132, "precision": 0.5818, "recall": 0.2424, "f2_score": 27.4, "f3_score": 25.7, "cvss_precision": 0.6601, "cvss_recall": 0.2716, "cvss_f3_score": 28.9 }, "strict_micro": { "tp": 256, "fp": 184, "fn": 2645, "tn": 152, "precision": 0.5818, "recall": 0.0882, "f2_score": 10.6, "f3_score": 9.6, "cvss_precision": 0.6601, "cvss_recall": 0.0935, "cvss_f3_score": 10.2 }, "macro": { "f2_score": 27.8 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 24 }, "high": { "tp": 120, "fp": 3, "fn": 307 }, "medium": { "tp": 75, "fp": 8, "fn": 480 }, "low": { "tp": 3, "fp": 0, "fn": 11 } }, "repos_scored": 35, "repos_total": 90, "f2_stddev": 14.1, "num_runs": 3, "language_coverage": { "python": [ 35, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 5.6347, "successful_runs": 73, "cost_per_run": 0.0772, "total_loc_scanned": 97712, "cost_per_100_loc": 0.0028 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 224, "fp": 208, "fn": 860, "tn": 136, "precision": 0.5185, "recall": 0.2066, "f2_score": 23.5, "f3_score": 22.0, "cvss_precision": 0.5971, "cvss_recall": 0.2218, "cvss_f3_score": 23.7 }, "strict_micro": { "tp": 224, "fp": 208, "fn": 2676, "tn": 152, "precision": 0.5185, "recall": 0.0772, "f2_score": 9.3, "f3_score": 8.4, "cvss_precision": 0.5971, "cvss_recall": 0.0782, "cvss_f3_score": 8.6 }, "macro": { "f2_score": 21.6 }, "per_severity": { "critical": { "tp": 24, "fp": 0, "fn": 36 }, "high": { "tp": 101, "fp": 3, "fn": 334 }, "medium": { "tp": 96, "fp": 4, "fn": 475 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 36, "repos_total": 90, "f2_stddev": 21.7, "num_runs": 1, "language_coverage": { "python": [ 36, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 36, "cost_per_run": 0.0, "total_loc_scanned": 100769, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 402, "fp": 305, "fn": 797, "tn": 152, "precision": 0.5686, "recall": 0.3353, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6687, "cvss_recall": 0.3572, "cvss_f3_score": 37.5 }, "strict_micro": { "tp": 402, "fp": 305, "fn": 2498, "tn": 152, "precision": 0.5686, "recall": 0.1386, "f2_score": 16.3, "f3_score": 15.0, "cvss_precision": 0.6687, "cvss_recall": 0.1398, "cvss_f3_score": 15.2 }, "macro": { "f2_score": 36.2 }, "per_severity": { "critical": { "tp": 50, "fp": 0, "fn": 17 }, "high": { "tp": 172, "fp": 1, "fn": 315 }, "medium": { "tp": 174, "fp": 6, "fn": 453 }, "low": { "tp": 6, "fp": 0, "fn": 12 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 19.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 40, "cost_per_run": 0.0, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 297, "fp": 1272, "fn": 902, "tn": 144, "precision": 0.1893, "recall": 0.2477, "f2_score": 23.3, "f3_score": 24.0, "cvss_precision": 0.279, "cvss_recall": 0.2713, "cvss_f3_score": 27.2 }, "strict_micro": { "tp": 297, "fp": 1272, "fn": 2603, "tn": 144, "precision": 0.1893, "recall": 0.1024, "f2_score": 11.3, "f3_score": 10.7, "cvss_precision": 0.279, "cvss_recall": 0.1062, "cvss_f3_score": 11.3 }, "macro": { "f2_score": 23.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 101, "fp": 13, "fn": 386 }, "medium": { "tp": 129, "fp": 2, "fn": 498 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 7.3, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 190, "fp": 1701, "fn": 2710, "tn": 159, "precision": 0.1005, "recall": 0.0655, "f2_score": 7.0, "f3_score": 6.8, "cvss_precision": 0.1233, "cvss_recall": 0.0765, "cvss_f3_score": 7.9 }, "strict_micro": { "tp": 190, "fp": 1701, "fn": 2710, "tn": 159, "precision": 0.1005, "recall": 0.0655, "f2_score": 7.0, "f3_score": 6.8, "cvss_precision": 0.1233, "cvss_recall": 0.0765, "cvss_f3_score": 7.9 }, "macro": { "f2_score": 6.0 }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 71 }, "high": { "tp": 189, "fp": 0, "fn": 1943 }, "medium": { "tp": 1, "fp": 0, "fn": 667 }, "low": { "tp": 0, "fp": 0, "fn": 29 } }, "repos_scored": 90, "repos_total": 90, "f2_stddev": 6.8, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 230, "fp": 1559, "fn": 969, "tn": 159, "precision": 0.1286, "recall": 0.1918, "f2_score": 17.5, "f3_score": 18.3, "cvss_precision": 0.1361, "cvss_recall": 0.1935, "cvss_f3_score": 18.6 }, "strict_micro": { "tp": 230, "fp": 1559, "fn": 2670, "tn": 159, "precision": 0.1286, "recall": 0.0793, "f2_score": 8.6, "f3_score": 8.2, "cvss_precision": 0.1361, "cvss_recall": 0.0757, "cvss_f3_score": 7.9 }, "macro": { "f2_score": 18.2 }, "per_severity": { "critical": { "tp": 31, "fp": 0, "fn": 36 }, "high": { "tp": 77, "fp": 0, "fn": 410 }, "medium": { "tp": 122, "fp": 0, "fn": 505 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 90, "f2_stddev": 5.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ], "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "python:vibe": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 814, "fp": 468, "fn": 385, "tn": 157, "precision": 0.6349, "recall": 0.6789, "f2_score": 67.0, "f3_score": 67.4, "cvss_precision": 0.6821, "cvss_recall": 0.6912, "cvss_f3_score": 69.0 }, "strict_micro": { "tp": 814, "fp": 468, "fn": 385, "tn": 157, "precision": 0.6349, "recall": 0.6789, "f2_score": 67.0, "f3_score": 67.4, "cvss_precision": 0.6821, "cvss_recall": 0.6912, "cvss_f3_score": 69.0 }, "macro": { "f2_score": 67.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 337, "fp": 1, "fn": 150 }, "medium": { "tp": 394, "fp": 1, "fn": 233 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 9.9, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 66.1096, "successful_runs": 40, "cost_per_run": 1.6527, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0581 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 644, "fp": 291, "fn": 555, "tn": 157, "precision": 0.6888, "recall": 0.5371, "f2_score": 56.2, "f3_score": 54.9, "cvss_precision": 0.7867, "cvss_recall": 0.5585, "cvss_f3_score": 57.5 }, "strict_micro": { "tp": 644, "fp": 291, "fn": 555, "tn": 157, "precision": 0.6888, "recall": 0.5371, "f2_score": 56.2, "f3_score": 54.9, "cvss_precision": 0.7867, "cvss_recall": 0.5585, "cvss_f3_score": 57.5 }, "macro": { "f2_score": 56.5 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 276, "fp": 0, "fn": 211 }, "medium": { "tp": 286, "fp": 2, "fn": 341 }, "low": { "tp": 17, "fp": 0, "fn": 1 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 10.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 25.0746, "successful_runs": 40, "cost_per_run": 0.6269, "total_loc_scanned": 113720, "cost_per_100_loc": 0.022 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 564, "fp": 150, "fn": 635, "tn": 154, "precision": 0.7899, "recall": 0.4704, "f2_score": 51.2, "f3_score": 49.0, "cvss_precision": 0.8437, "cvss_recall": 0.4908, "cvss_f3_score": 51.2 }, "strict_micro": { "tp": 564, "fp": 150, "fn": 635, "tn": 154, "precision": 0.7899, "recall": 0.4704, "f2_score": 51.2, "f3_score": 49.0, "cvss_precision": 0.8437, "cvss_recall": 0.4908, "cvss_f3_score": 51.2 }, "macro": { "f2_score": 51.5 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 238, "fp": 0, "fn": 249 }, "medium": { "tp": 241, "fp": 3, "fn": 386 }, "low": { "tp": 18, "fp": 2, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 7.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.5358, "successful_runs": 40, "cost_per_run": 0.0134, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0005 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 562, "fp": 157, "fn": 637, "tn": 158, "precision": 0.7816, "recall": 0.4687, "f2_score": 51.0, "f3_score": 48.8, "cvss_precision": 0.8615, "cvss_recall": 0.4956, "cvss_f3_score": 51.8 }, "strict_micro": { "tp": 562, "fp": 157, "fn": 637, "tn": 158, "precision": 0.7816, "recall": 0.4687, "f2_score": 51.0, "f3_score": 48.8, "cvss_precision": 0.8615, "cvss_recall": 0.4956, "cvss_f3_score": 51.8 }, "macro": { "f2_score": 51.2 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 247, "fp": 0, "fn": 240 }, "medium": { "tp": 232, "fp": 1, "fn": 395 }, "low": { "tp": 16, "fp": 0, "fn": 2 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 5.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 1.6415, "successful_runs": 40, "cost_per_run": 0.041, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0014 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 692, "fp": 403, "fn": 507, "tn": 154, "precision": 0.632, "recall": 0.5771, "f2_score": 58.7, "f3_score": 58.2, "cvss_precision": 0.6841, "cvss_recall": 0.5912, "cvss_f3_score": 59.9 }, "strict_micro": { "tp": 692, "fp": 403, "fn": 507, "tn": 154, "precision": 0.632, "recall": 0.5771, "f2_score": 58.7, "f3_score": 58.2, "cvss_precision": 0.6841, "cvss_recall": 0.5912, "cvss_f3_score": 59.9 }, "macro": { "f2_score": 58.8 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 298, "fp": 0, "fn": 189 }, "medium": { "tp": 311, "fp": 5, "fn": 316 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 10.7, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 40, "cost_per_run": 0.0, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 387, "fp": 30, "fn": 783, "tn": 155, "precision": 0.9281, "recall": 0.3308, "f2_score": 38.0, "f3_score": 35.4, "cvss_precision": 0.9387, "cvss_recall": 0.3594, "cvss_f3_score": 38.3 }, "strict_micro": { "tp": 387, "fp": 30, "fn": 813, "tn": 159, "precision": 0.9281, "recall": 0.3225, "f2_score": 37.1, "f3_score": 34.5, "cvss_precision": 0.9387, "cvss_recall": 0.3501, "cvss_f3_score": 37.3 }, "macro": { "f2_score": 38.1 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 3 }, "high": { "tp": 184, "fp": 0, "fn": 292 }, "medium": { "tp": 143, "fp": 1, "fn": 466 }, "low": { "tp": 2, "fp": 0, "fn": 16 } }, "repos_scored": 39, "repos_total": 40, "f2_stddev": 7.1, "num_runs": 3, "language_coverage": { "python": [ 39, 40 ] }, "cost": { "total_cost": 60.5806, "successful_runs": 90, "cost_per_run": 0.6731, "total_loc_scanned": 111246, "cost_per_100_loc": 0.0232 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 262, "fp": 27, "fn": 937, "tn": 159, "precision": 0.9066, "recall": 0.2185, "f2_score": 25.8, "f3_score": 23.6, "cvss_precision": 0.9624, "cvss_recall": 0.2481, "cvss_f3_score": 26.8 }, "strict_micro": { "tp": 262, "fp": 27, "fn": 937, "tn": 159, "precision": 0.9066, "recall": 0.2185, "f2_score": 25.8, "f3_score": 23.6, "cvss_precision": 0.9624, "cvss_recall": 0.2481, "cvss_f3_score": 26.8 }, "macro": { "f2_score": 25.1 }, "per_severity": { "critical": { "tp": 46, "fp": 0, "fn": 21 }, "high": { "tp": 134, "fp": 0, "fn": 353 }, "medium": { "tp": 78, "fp": 0, "fn": 549 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 17.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 40, "cost_per_run": 0.0, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 366, "fp": 78, "fn": 833, "tn": 159, "precision": 0.8243, "recall": 0.3053, "f2_score": 34.9, "f3_score": 32.6, "cvss_precision": 0.8773, "cvss_recall": 0.3162, "cvss_f3_score": 33.8 }, "strict_micro": { "tp": 366, "fp": 78, "fn": 833, "tn": 159, "precision": 0.8243, "recall": 0.3053, "f2_score": 34.9, "f3_score": 32.6, "cvss_precision": 0.8773, "cvss_recall": 0.3162, "cvss_f3_score": 33.8 }, "macro": { "f2_score": 33.7 }, "per_severity": { "critical": { "tp": 44, "fp": 0, "fn": 23 }, "high": { "tp": 152, "fp": 0, "fn": 335 }, "medium": { "tp": 165, "fp": 1, "fn": 462 }, "low": { "tp": 4, "fp": 0, "fn": 14 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 22.9, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 9.2202, "successful_runs": 120, "cost_per_run": 0.0768, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0027 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 461, "fp": 179, "fn": 738, "tn": 159, "precision": 0.7203, "recall": 0.3845, "f2_score": 42.4, "f3_score": 40.3, "cvss_precision": 0.8025, "cvss_recall": 0.3968, "cvss_f3_score": 41.8 }, "strict_micro": { "tp": 461, "fp": 179, "fn": 738, "tn": 159, "precision": 0.7203, "recall": 0.3845, "f2_score": 42.4, "f3_score": 40.3, "cvss_precision": 0.8025, "cvss_recall": 0.3968, "cvss_f3_score": 41.8 }, "macro": { "f2_score": 40.5 }, "per_severity": { "critical": { "tp": 49, "fp": 0, "fn": 18 }, "high": { "tp": 200, "fp": 0, "fn": 287 }, "medium": { "tp": 207, "fp": 0, "fn": 420 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 26.4, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 22.052, "successful_runs": 120, "cost_per_run": 0.1838, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0065 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 448, "fp": 270, "fn": 751, "tn": 159, "precision": 0.624, "recall": 0.3736, "f2_score": 40.6, "f3_score": 38.9, "cvss_precision": 0.7499, "cvss_recall": 0.3871, "cvss_f3_score": 40.7 }, "strict_micro": { "tp": 448, "fp": 270, "fn": 751, "tn": 159, "precision": 0.624, "recall": 0.3736, "f2_score": 40.6, "f3_score": 38.9, "cvss_precision": 0.7499, "cvss_recall": 0.3871, "cvss_f3_score": 40.7 }, "macro": { "f2_score": 38.2 }, "per_severity": { "critical": { "tp": 43, "fp": 0, "fn": 24 }, "high": { "tp": 187, "fp": 0, "fn": 300 }, "medium": { "tp": 195, "fp": 0, "fn": 432 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 26.6, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 17.3582, "successful_runs": 120, "cost_per_run": 0.1447, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0051 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 755, "fp": 536, "fn": 444, "tn": 154, "precision": 0.5848, "recall": 0.6297, "f2_score": 62.0, "f3_score": 62.5, "cvss_precision": 0.6685, "cvss_recall": 0.6477, "cvss_f3_score": 65.0 }, "strict_micro": { "tp": 755, "fp": 536, "fn": 444, "tn": 154, "precision": 0.5848, "recall": 0.6297, "f2_score": 62.0, "f3_score": 62.5, "cvss_precision": 0.6685, "cvss_recall": 0.6477, "cvss_f3_score": 65.0 }, "macro": { "f2_score": 62.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 335, "fp": 0, "fn": 152 }, "medium": { "tp": 337, "fp": 5, "fn": 290 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 8.7, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 23.2683, "successful_runs": 40, "cost_per_run": 0.5817, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0205 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 643, "fp": 320, "fn": 556, "tn": 159, "precision": 0.6677, "recall": 0.5363, "f2_score": 55.8, "f3_score": 54.7, "cvss_precision": 0.7704, "cvss_recall": 0.5727, "cvss_f3_score": 58.8 }, "strict_micro": { "tp": 643, "fp": 320, "fn": 556, "tn": 159, "precision": 0.6677, "recall": 0.5363, "f2_score": 55.8, "f3_score": 54.7, "cvss_precision": 0.7704, "cvss_recall": 0.5727, "cvss_f3_score": 58.8 }, "macro": { "f2_score": 55.8 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 293, "fp": 0, "fn": 194 }, "medium": { "tp": 259, "fp": 1, "fn": 368 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 6.6, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 77.6882, "successful_runs": 120, "cost_per_run": 0.6474, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0228 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 505, "fp": 130, "fn": 694, "tn": 157, "precision": 0.7953, "recall": 0.4212, "f2_score": 46.5, "f3_score": 44.2, "cvss_precision": 0.8642, "cvss_recall": 0.4497, "cvss_f3_score": 47.2 }, "strict_micro": { "tp": 505, "fp": 130, "fn": 694, "tn": 157, "precision": 0.7953, "recall": 0.4212, "f2_score": 46.5, "f3_score": 44.2, "cvss_precision": 0.8642, "cvss_recall": 0.4497, "cvss_f3_score": 47.2 }, "macro": { "f2_score": 46.5 }, "per_severity": { "critical": { "tp": 63, "fp": 0, "fn": 4 }, "high": { "tp": 221, "fp": 0, "fn": 266 }, "medium": { "tp": 209, "fp": 2, "fn": 418 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 12.6, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.7536, "successful_runs": 40, "cost_per_run": 0.0188, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0007 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 1031, "fp": 429, "fn": 168, "tn": 157, "precision": 0.7062, "recall": 0.8599, "f2_score": 82.4, "f3_score": 84.2, "cvss_precision": 0.7438, "cvss_recall": 0.8704, "cvss_f3_score": 85.6 }, "strict_micro": { "tp": 1031, "fp": 429, "fn": 168, "tn": 157, "precision": 0.7062, "recall": 0.8599, "f2_score": 82.4, "f3_score": 84.2, "cvss_precision": 0.7438, "cvss_recall": 0.8704, "cvss_f3_score": 85.6 }, "macro": { "f2_score": 81.7 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 430, "fp": 1, "fn": 57 }, "medium": { "tp": 518, "fp": 1, "fn": 109 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 17.8, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 127.4969, "successful_runs": 40, "cost_per_run": 3.1874, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1121 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 561, "fp": 212, "fn": 638, "tn": 158, "precision": 0.7257, "recall": 0.4679, "f2_score": 50.4, "f3_score": 48.5, "cvss_precision": 0.7918, "cvss_recall": 0.5103, "cvss_f3_score": 52.9 }, "strict_micro": { "tp": 561, "fp": 212, "fn": 638, "tn": 158, "precision": 0.7257, "recall": 0.4679, "f2_score": 50.4, "f3_score": 48.5, "cvss_precision": 0.7918, "cvss_recall": 0.5103, "cvss_f3_score": 52.9 }, "macro": { "f2_score": 50.5 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 277, "fp": 0, "fn": 210 }, "medium": { "tp": 203, "fp": 1, "fn": 424 }, "low": { "tp": 16, "fp": 0, "fn": 2 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 10.2, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 22.3235, "successful_runs": 40, "cost_per_run": 0.5581, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0196 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 551, "fp": 470, "fn": 648, "tn": 156, "precision": 0.5397, "recall": 0.4595, "f2_score": 47.4, "f3_score": 46.6, "cvss_precision": 0.6129, "cvss_recall": 0.5087, "cvss_f3_score": 51.7 }, "strict_micro": { "tp": 551, "fp": 470, "fn": 648, "tn": 156, "precision": 0.5397, "recall": 0.4595, "f2_score": 47.4, "f3_score": 46.6, "cvss_precision": 0.6129, "cvss_recall": 0.5087, "cvss_f3_score": 51.7 }, "macro": { "f2_score": 47.1 }, "per_severity": { "critical": { "tp": 59, "fp": 0, "fn": 8 }, "high": { "tp": 282, "fp": 1, "fn": 205 }, "medium": { "tp": 194, "fp": 2, "fn": 433 }, "low": { "tp": 16, "fp": 0, "fn": 2 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 9.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 214.9971, "successful_runs": 40, "cost_per_run": 5.3749, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1891 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 1077, "fp": 325, "fn": 122, "tn": 158, "precision": 0.7682, "recall": 0.8982, "f2_score": 86.9, "f3_score": 88.3, "cvss_precision": 0.8018, "cvss_recall": 0.9017, "cvss_f3_score": 89.1 }, "strict_micro": { "tp": 1077, "fp": 325, "fn": 122, "tn": 158, "precision": 0.7682, "recall": 0.8982, "f2_score": 86.9, "f3_score": 88.3, "cvss_precision": 0.8018, "cvss_recall": 0.9017, "cvss_f3_score": 89.1 }, "macro": { "f2_score": 86.4 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 441, "fp": 0, "fn": 46 }, "medium": { "tp": 553, "fp": 1, "fn": 74 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 16.0, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 123.4331, "successful_runs": 40, "cost_per_run": 3.0858, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1085 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 499, "fp": 165, "fn": 699, "tn": 157, "precision": 0.7515, "recall": 0.4165, "f2_score": 45.7, "f3_score": 43.6, "cvss_precision": 0.8295, "cvss_recall": 0.4336, "cvss_f3_score": 45.5 }, "strict_micro": { "tp": 499, "fp": 165, "fn": 699, "tn": 157, "precision": 0.7515, "recall": 0.4165, "f2_score": 45.7, "f3_score": 43.6, "cvss_precision": 0.8295, "cvss_recall": 0.4336, "cvss_f3_score": 45.5 }, "macro": { "f2_score": 45.9 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 206, "fp": 1, "fn": 281 }, "medium": { "tp": 217, "fp": 2, "fn": 410 }, "low": { "tp": 14, "fp": 0, "fn": 4 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 6.1, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 5.7125, "successful_runs": 116, "cost_per_run": 0.0492, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0018 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 519, "fp": 210, "fn": 681, "tn": 159, "precision": 0.7119, "recall": 0.4325, "f2_score": 46.9, "f3_score": 45.0, "cvss_precision": 0.8217, "cvss_recall": 0.4574, "cvss_f3_score": 47.9 }, "strict_micro": { "tp": 519, "fp": 210, "fn": 681, "tn": 159, "precision": 0.7119, "recall": 0.4325, "f2_score": 46.9, "f3_score": 45.0, "cvss_precision": 0.8217, "cvss_recall": 0.4574, "cvss_f3_score": 47.9 }, "macro": { "f2_score": 46.8 }, "per_severity": { "critical": { "tp": 61, "fp": 0, "fn": 6 }, "high": { "tp": 222, "fp": 0, "fn": 265 }, "medium": { "tp": 209, "fp": 0, "fn": 418 }, "low": { "tp": 17, "fp": 0, "fn": 1 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 10.5, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 14.5495, "successful_runs": 92, "cost_per_run": 0.1581, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0052 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 580, "fp": 290, "fn": 618, "tn": 158, "precision": 0.6667, "recall": 0.4841, "f2_score": 51.2, "f3_score": 49.8, "cvss_precision": 0.8087, "cvss_recall": 0.5151, "cvss_f3_score": 53.4 }, "strict_micro": { "tp": 580, "fp": 290, "fn": 618, "tn": 158, "precision": 0.6667, "recall": 0.4841, "f2_score": 51.2, "f3_score": 49.8, "cvss_precision": 0.8087, "cvss_recall": 0.5151, "cvss_f3_score": 53.4 }, "macro": { "f2_score": 51.2 }, "per_severity": { "critical": { "tp": 66, "fp": 0, "fn": 1 }, "high": { "tp": 248, "fp": 0, "fn": 239 }, "medium": { "tp": 248, "fp": 3, "fn": 379 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 6.3, "num_runs": 3, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 17.4576, "successful_runs": 109, "cost_per_run": 0.1602, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0057 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 709, "fp": 316, "fn": 490, "tn": 158, "precision": 0.6917, "recall": 0.5913, "f2_score": 60.9, "f3_score": 60.0, "cvss_precision": 0.81, "cvss_recall": 0.6103, "cvss_f3_score": 62.6 }, "strict_micro": { "tp": 709, "fp": 316, "fn": 490, "tn": 158, "precision": 0.6917, "recall": 0.5913, "f2_score": 60.9, "f3_score": 60.0, "cvss_precision": 0.81, "cvss_recall": 0.6103, "cvss_f3_score": 62.6 }, "macro": { "f2_score": 61.1 }, "per_severity": { "critical": { "tp": 65, "fp": 0, "fn": 2 }, "high": { "tp": 310, "fp": 0, "fn": 177 }, "medium": { "tp": 316, "fp": 1, "fn": 311 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 9.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 15.5822, "successful_runs": 40, "cost_per_run": 0.3896, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0137 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 574, "fp": 310, "fn": 625, "tn": 145, "precision": 0.6493, "recall": 0.4787, "f2_score": 50.5, "f3_score": 49.2, "cvss_precision": 0.6666, "cvss_recall": 0.5024, "cvss_f3_score": 51.5 }, "strict_micro": { "tp": 574, "fp": 310, "fn": 625, "tn": 145, "precision": 0.6493, "recall": 0.4787, "f2_score": 50.5, "f3_score": 49.2, "cvss_precision": 0.6666, "cvss_recall": 0.5024, "cvss_f3_score": 51.5 }, "macro": { "f2_score": 50.1 }, "per_severity": { "critical": { "tp": 57, "fp": 0, "fn": 10 }, "high": { "tp": 265, "fp": 1, "fn": 222 }, "medium": { "tp": 244, "fp": 13, "fn": 383 }, "low": { "tp": 8, "fp": 0, "fn": 10 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 18.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 217.937, "successful_runs": 40, "cost_per_run": 5.4484, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1916 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 945, "fp": 2130, "fn": 254, "tn": 144, "precision": 0.3073, "recall": 0.7882, "f2_score": 60.0, "f3_score": 68.2, "cvss_precision": 0.2823, "cvss_recall": 0.7986, "cvss_f3_score": 67.5 }, "strict_micro": { "tp": 945, "fp": 2130, "fn": 254, "tn": 144, "precision": 0.3073, "recall": 0.7882, "f2_score": 60.0, "f3_score": 68.2, "cvss_precision": 0.2823, "cvss_recall": 0.7986, "cvss_f3_score": 67.5 }, "macro": { "f2_score": 59.8 }, "per_severity": { "critical": { "tp": 64, "fp": 0, "fn": 3 }, "high": { "tp": 379, "fp": 7, "fn": 108 }, "medium": { "tp": 484, "fp": 7, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 7.6, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 120.345, "successful_runs": 40, "cost_per_run": 3.0086, "total_loc_scanned": 113720, "cost_per_100_loc": 0.1058 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 865, "fp": 1144, "fn": 334, "tn": 148, "precision": 0.4306, "recall": 0.7214, "f2_score": 63.6, "f3_score": 67.6, "cvss_precision": 0.3979, "cvss_recall": 0.7412, "cvss_f3_score": 68.2 }, "strict_micro": { "tp": 865, "fp": 1144, "fn": 334, "tn": 148, "precision": 0.4306, "recall": 0.7214, "f2_score": 63.6, "f3_score": 67.6, "cvss_precision": 0.3979, "cvss_recall": 0.7412, "cvss_f3_score": 68.2 }, "macro": { "f2_score": 63.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 357, "fp": 5, "fn": 130 }, "medium": { "tp": 427, "fp": 5, "fn": 200 }, "low": { "tp": 14, "fp": 1, "fn": 4 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 8.1, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 18.3403, "successful_runs": 40, "cost_per_run": 0.4585, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0161 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 110, "fp": 58, "fn": 1089, "tn": 158, "precision": 0.6548, "recall": 0.0917, "f2_score": 11.1, "f3_score": 10.0, "cvss_precision": 0.6362, "cvss_recall": 0.1049, "cvss_f3_score": 11.4 }, "strict_micro": { "tp": 110, "fp": 58, "fn": 1089, "tn": 158, "precision": 0.6548, "recall": 0.0917, "f2_score": 11.1, "f3_score": 10.0, "cvss_precision": 0.6362, "cvss_recall": 0.1049, "cvss_f3_score": 11.4 }, "macro": { "f2_score": 10.8 }, "per_severity": { "critical": { "tp": 1, "fp": 0, "fn": 66 }, "high": { "tp": 76, "fp": 1, "fn": 411 }, "medium": { "tp": 30, "fp": 0, "fn": 597 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 7.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 939, "fp": 2035, "fn": 260, "tn": 144, "precision": 0.3157, "recall": 0.7832, "f2_score": 60.4, "f3_score": 68.2, "cvss_precision": 0.2826, "cvss_recall": 0.7921, "cvss_f3_score": 67.1 }, "strict_micro": { "tp": 939, "fp": 2035, "fn": 260, "tn": 144, "precision": 0.3157, "recall": 0.7832, "f2_score": 60.4, "f3_score": 68.2, "cvss_precision": 0.2826, "cvss_recall": 0.7921, "cvss_f3_score": 67.1 }, "macro": { "f2_score": 60.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 381, "fp": 4, "fn": 106 }, "medium": { "tp": 473, "fp": 10, "fn": 154 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 6.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 1064, "fp": 478, "fn": 135, "tn": 151, "precision": 0.69, "recall": 0.8874, "f2_score": 83.9, "f3_score": 86.3, "cvss_precision": 0.6322, "cvss_recall": 0.8904, "cvss_f3_score": 85.5 }, "strict_micro": { "tp": 1064, "fp": 478, "fn": 135, "tn": 151, "precision": 0.69, "recall": 0.8874, "f2_score": 83.9, "f3_score": 86.3, "cvss_precision": 0.6322, "cvss_recall": 0.8904, "cvss_f3_score": 85.5 }, "macro": { "f2_score": 84.1 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 418, "fp": 3, "fn": 69 }, "medium": { "tp": 561, "fp": 5, "fn": 66 }, "low": { "tp": 18, "fp": 0, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 6.3, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 625, "fp": 819, "fn": 574, "tn": 157, "precision": 0.4328, "recall": 0.5213, "f2_score": 50.1, "f3_score": 51.1, "cvss_precision": 0.4364, "cvss_recall": 0.5452, "cvss_f3_score": 53.2 }, "strict_micro": { "tp": 625, "fp": 819, "fn": 574, "tn": 157, "precision": 0.4328, "recall": 0.5213, "f2_score": 50.1, "f3_score": 51.1, "cvss_precision": 0.4364, "cvss_recall": 0.5452, "cvss_f3_score": 53.2 }, "macro": { "f2_score": 49.3 }, "per_severity": { "critical": { "tp": 53, "fp": 0, "fn": 14 }, "high": { "tp": 257, "fp": 1, "fn": 230 }, "medium": { "tp": 303, "fp": 1, "fn": 324 }, "low": { "tp": 12, "fp": 0, "fn": 6 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 13.7, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 954, "fp": 2945, "fn": 245, "tn": 144, "precision": 0.2447, "recall": 0.7957, "f2_score": 54.9, "f3_score": 64.9, "cvss_precision": 0.2244, "cvss_recall": 0.8055, "cvss_f3_score": 64.0 }, "strict_micro": { "tp": 954, "fp": 2945, "fn": 245, "tn": 144, "precision": 0.2447, "recall": 0.7957, "f2_score": 54.9, "f3_score": 64.9, "cvss_precision": 0.2244, "cvss_recall": 0.8055, "cvss_f3_score": 64.0 }, "macro": { "f2_score": 55.3 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 385, "fp": 4, "fn": 102 }, "medium": { "tp": 484, "fp": 10, "fn": 143 }, "low": { "tp": 18, "fp": 1, "fn": 0 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 7.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 256, "fp": 184, "fn": 800, "tn": 132, "precision": 0.5818, "recall": 0.2424, "f2_score": 27.4, "f3_score": 25.7, "cvss_precision": 0.6601, "cvss_recall": 0.2716, "cvss_f3_score": 28.9 }, "strict_micro": { "tp": 256, "fp": 184, "fn": 944, "tn": 152, "precision": 0.5818, "recall": 0.2133, "f2_score": 24.4, "f3_score": 22.8, "cvss_precision": 0.6601, "cvss_recall": 0.2388, "cvss_f3_score": 25.5 }, "macro": { "f2_score": 27.8 }, "per_severity": { "critical": { "tp": 35, "fp": 0, "fn": 24 }, "high": { "tp": 120, "fp": 3, "fn": 307 }, "medium": { "tp": 75, "fp": 8, "fn": 480 }, "low": { "tp": 3, "fp": 0, "fn": 11 } }, "repos_scored": 35, "repos_total": 40, "f2_stddev": 14.1, "num_runs": 3, "language_coverage": { "python": [ 35, 40 ] }, "cost": { "total_cost": 5.6347, "successful_runs": 73, "cost_per_run": 0.0772, "total_loc_scanned": 97712, "cost_per_100_loc": 0.0028 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 224, "fp": 208, "fn": 860, "tn": 136, "precision": 0.5185, "recall": 0.2066, "f2_score": 23.5, "f3_score": 22.0, "cvss_precision": 0.5971, "cvss_recall": 0.2218, "cvss_f3_score": 23.7 }, "strict_micro": { "tp": 224, "fp": 208, "fn": 975, "tn": 152, "precision": 0.5185, "recall": 0.1868, "f2_score": 21.4, "f3_score": 20.0, "cvss_precision": 0.5971, "cvss_recall": 0.2, "cvss_f3_score": 21.4 }, "macro": { "f2_score": 21.6 }, "per_severity": { "critical": { "tp": 24, "fp": 0, "fn": 36 }, "high": { "tp": 101, "fp": 3, "fn": 334 }, "medium": { "tp": 96, "fp": 4, "fn": 475 }, "low": { "tp": 3, "fp": 0, "fn": 15 } }, "repos_scored": 36, "repos_total": 40, "f2_stddev": 21.7, "num_runs": 1, "language_coverage": { "python": [ 36, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 36, "cost_per_run": 0.0, "total_loc_scanned": 100769, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 402, "fp": 305, "fn": 797, "tn": 152, "precision": 0.5686, "recall": 0.3353, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6687, "cvss_recall": 0.3572, "cvss_f3_score": 37.5 }, "strict_micro": { "tp": 402, "fp": 305, "fn": 797, "tn": 152, "precision": 0.5686, "recall": 0.3353, "f2_score": 36.5, "f3_score": 35.0, "cvss_precision": 0.6687, "cvss_recall": 0.3572, "cvss_f3_score": 37.5 }, "macro": { "f2_score": 36.2 }, "per_severity": { "critical": { "tp": 50, "fp": 0, "fn": 17 }, "high": { "tp": 172, "fp": 1, "fn": 315 }, "medium": { "tp": 174, "fp": 6, "fn": 453 }, "low": { "tp": 6, "fp": 0, "fn": 12 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 19.5, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 40, "cost_per_run": 0.0, "total_loc_scanned": 113720, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 297, "fp": 1272, "fn": 902, "tn": 144, "precision": 0.1893, "recall": 0.2477, "f2_score": 23.3, "f3_score": 24.0, "cvss_precision": 0.279, "cvss_recall": 0.2713, "cvss_f3_score": 27.2 }, "strict_micro": { "tp": 297, "fp": 1272, "fn": 902, "tn": 144, "precision": 0.1893, "recall": 0.2477, "f2_score": 23.3, "f3_score": 24.0, "cvss_precision": 0.279, "cvss_recall": 0.2713, "cvss_f3_score": 27.2 }, "macro": { "f2_score": 23.6 }, "per_severity": { "critical": { "tp": 67, "fp": 0, "fn": 0 }, "high": { "tp": 101, "fp": 13, "fn": 386 }, "medium": { "tp": 129, "fp": 2, "fn": 498 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 7.3, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 0, "fp": 424, "fn": 1199, "tn": 159, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 424, "fn": 1199, "tn": 159, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": { "critical": { "tp": 0, "fp": 0, "fn": 67 }, "high": { "tp": 0, "fp": 0, "fn": 487 }, "medium": { "tp": 0, "fp": 0, "fn": 627 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 230, "fp": 1559, "fn": 969, "tn": 159, "precision": 0.1286, "recall": 0.1918, "f2_score": 17.5, "f3_score": 18.3, "cvss_precision": 0.1361, "cvss_recall": 0.1935, "cvss_f3_score": 18.6 }, "strict_micro": { "tp": 230, "fp": 1559, "fn": 969, "tn": 159, "precision": 0.1286, "recall": 0.1918, "f2_score": 17.5, "f3_score": 18.3, "cvss_precision": 0.1361, "cvss_recall": 0.1935, "cvss_f3_score": 18.6 }, "macro": { "f2_score": 18.2 }, "per_severity": { "critical": { "tp": 31, "fp": 0, "fn": 36 }, "high": { "tp": 77, "fp": 0, "fn": 410 }, "medium": { "tp": 122, "fp": 0, "fn": 505 }, "low": { "tp": 0, "fp": 0, "fn": 18 } }, "repos_scored": 40, "repos_total": 40, "f2_stddev": 5.4, "num_runs": 1, "language_coverage": { "python": [ 40, 40 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } }, "tsjs:vibe": { "claude-opus-5-cc-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-opus-5", "prompt_version": "sha256:de50937cb83f", "prompt_label": "generic-agentic-v1", "reasoning_effort": null, "avg_input_tokens": 37, "avg_output_tokens": 16295, "avg_total_tokens": 704090, "avg_wall_clock_seconds": 208.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "claude-sonnet-5-cc-agentic-v1": { "micro": { "tp": 598, "fp": 828, "fn": 1103, "tn": 0, "precision": 0.4194, "recall": 0.3516, "f2_score": 36.3, "f3_score": 35.7, "cvss_precision": 0.4485, "cvss_recall": 0.373, "cvss_f3_score": 37.9 }, "strict_micro": { "tp": 598, "fp": 828, "fn": 1103, "tn": 0, "precision": 0.4194, "recall": 0.3516, "f2_score": 36.3, "f3_score": 35.7, "cvss_precision": 0.4485, "cvss_recall": 0.373, "cvss_f3_score": 37.9 }, "macro": { "f2_score": 35.0 }, "per_severity": { "high": { "tp": 590, "fp": 0, "fn": 1055 }, "low": { "tp": 1, "fp": 0, "fn": 10 }, "medium": { "tp": 6, "fp": 0, "fn": 35 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 11.0, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 82.9916, "successful_runs": 50, "cost_per_run": 1.6598, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0176 }, "metadata": { "has_metrics": true, "model": "sonnet", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "generic-agentic-v1", "reasoning_effort": "high", "avg_input_tokens": 20, "avg_output_tokens": 20969, "avg_total_tokens": 945627, "avg_wall_clock_seconds": 230.0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "deepseek-v4-flash-agentic-v1": { "micro": { "tp": 580, "fp": 750, "fn": 1121, "tn": 0, "precision": 0.4361, "recall": 0.341, "f2_score": 35.7, "f3_score": 34.9, "cvss_precision": 0.4865, "cvss_recall": 0.3667, "cvss_f3_score": 37.6 }, "strict_micro": { "tp": 580, "fp": 750, "fn": 1121, "tn": 0, "precision": 0.4361, "recall": 0.341, "f2_score": 35.7, "f3_score": 34.9, "cvss_precision": 0.4865, "cvss_recall": 0.3667, "cvss_f3_score": 37.6 }, "macro": { "f2_score": 35.1 }, "per_severity": { "high": { "tp": 571, "fp": 0, "fn": 1074 }, "low": { "tp": 0, "fp": 0, "fn": 11 }, "medium": { "tp": 8, "fp": 0, "fn": 33 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 10.0, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 1.9241, "successful_runs": 50, "cost_per_run": 0.0385, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0004 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-flash", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": null, "avg_input_tokens": 56744, "avg_output_tokens": 18502, "avg_total_tokens": 830212, "avg_wall_clock_seconds": 231.8, "json_repair_rate": 0.036, "exit_status_counts": { "success": 188, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4-pro-agentic-v1": { "micro": { "tp": 428, "fp": 485, "fn": 1273, "tn": 0, "precision": 0.4688, "recall": 0.2516, "f2_score": 27.7, "f3_score": 26.4, "cvss_precision": 0.527, "cvss_recall": 0.267, "cvss_f3_score": 28.1 }, "strict_micro": { "tp": 428, "fp": 485, "fn": 1273, "tn": 0, "precision": 0.4688, "recall": 0.2516, "f2_score": 27.7, "f3_score": 26.4, "cvss_precision": 0.527, "cvss_recall": 0.267, "cvss_f3_score": 28.1 }, "macro": { "f2_score": 25.4 }, "per_severity": { "high": { "tp": 420, "fp": 0, "fn": 1225 }, "low": { "tp": 1, "fp": 0, "fn": 10 }, "medium": { "tp": 6, "fp": 0, "fn": 35 }, "critical": { "tp": 1, "fp": 0, "fn": 3 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 19.7, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 3.0012, "successful_runs": 50, "cost_per_run": 0.06, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0006 }, "metadata": { "has_metrics": true, "model": "deepseek-v4-pro", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46216, "avg_output_tokens": 13250, "avg_total_tokens": 398916, "avg_wall_clock_seconds": 285.4, "json_repair_rate": 0.094, "exit_status_counts": { "success": 185, "timeout": 3, "validation_failed": 4 }, "total_runs": 192 } }, "deepseek-v4.1-flash-agentic-v1": { "micro": { "tp": 780, "fp": 1005, "fn": 921, "tn": 0, "precision": 0.437, "recall": 0.4586, "f2_score": 45.4, "f3_score": 45.6, "cvss_precision": 0.4537, "cvss_recall": 0.4717, "cvss_f3_score": 47.0 }, "strict_micro": { "tp": 780, "fp": 1005, "fn": 921, "tn": 0, "precision": 0.437, "recall": 0.4586, "f2_score": 45.4, "f3_score": 45.6, "cvss_precision": 0.4537, "cvss_recall": 0.4717, "cvss_f3_score": 47.0 }, "macro": { "f2_score": 44.7 }, "per_severity": { "high": { "tp": 772, "fp": 0, "fn": 873 }, "low": { "tp": 1, "fp": 0, "fn": 10 }, "medium": { "tp": 7, "fp": 0, "fn": 34 }, "critical": { "tp": 0, "fp": 0, "fn": 4 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 12.7, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 50, "cost_per_run": 0.0, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0 }, "metadata": { "has_metrics": true, "model": "deepseek-v4.1-flash-expires-on-0910", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 84245, "avg_output_tokens": 21747, "avg_total_tokens": 987669, "avg_wall_clock_seconds": 97.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gemini-3.5-flash-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemini-3.5-flash", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 133767, "avg_output_tokens": 4170, "avg_total_tokens": 840691, "avg_wall_clock_seconds": 175.4, "json_repair_rate": 0.027, "exit_status_counts": { "success": 147, "validation_failed": 1, "timeout": 1 }, "total_runs": 149 } }, "gemma4-31b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gemma4-31b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 122874, "avg_output_tokens": 4404, "avg_total_tokens": 127278, "avg_wall_clock_seconds": 303.8, "json_repair_rate": 0.197, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "glm-5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 24464, "avg_output_tokens": 4264, "avg_total_tokens": 162686, "avg_wall_clock_seconds": 154.7, "json_repair_rate": 0.182, "exit_status_counts": { "success": 186, "timeout": 9, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.1-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.1", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 45953, "avg_output_tokens": 9681, "avg_total_tokens": 174480, "avg_wall_clock_seconds": 198.4, "json_repair_rate": 0.197, "exit_status_counts": { "success": 195, "validation_failed": 3 }, "total_runs": 198 } }, "glm-5.2-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "glm-5.2", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 46538, "avg_output_tokens": 17972, "avg_total_tokens": 355284, "avg_wall_clock_seconds": 357.7, "json_repair_rate": 0.237, "exit_status_counts": { "success": 197, "validation_failed": 1 }, "total_runs": 198 } }, "glm-5.3-agentic-v1": { "micro": { "tp": 876, "fp": 1540, "fn": 708, "tn": 0, "precision": 0.3626, "recall": 0.553, "f2_score": 50.0, "f3_score": 52.5, "cvss_precision": 0.3932, "cvss_recall": 0.5693, "cvss_f3_score": 54.5 }, "strict_micro": { "tp": 876, "fp": 1540, "fn": 825, "tn": 0, "precision": 0.3626, "recall": 0.515, "f2_score": 47.5, "f3_score": 49.4, "cvss_precision": 0.3932, "cvss_recall": 0.53, "cvss_f3_score": 51.2 }, "macro": { "f2_score": 49.2 }, "per_severity": { "high": { "tp": 857, "fp": 0, "fn": 675 }, "low": { "tp": 2, "fp": 0, "fn": 9 }, "medium": { "tp": 17, "fp": 0, "fn": 22 }, "critical": { "tp": 0, "fp": 0, "fn": 2 } }, "repos_scored": 47, "repos_total": 50, "f2_stddev": 7.4, "num_runs": 1, "language_coverage": { "tsjs": [ 47, 50 ] }, "cost": { "total_cost": 59.5555, "successful_runs": 47, "cost_per_run": 1.2671, "total_loc_scanned": 447786, "cost_per_100_loc": 0.0133 }, "metadata": { "has_metrics": true, "model": "glm-5.3", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 102958, "avg_output_tokens": 35387, "avg_total_tokens": 1460633, "avg_wall_clock_seconds": 518.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 4 }, "total_runs": 140 } }, "gpt-5.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 69267, "avg_output_tokens": 9637, "avg_total_tokens": 476703, "avg_wall_clock_seconds": 180.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 196, "timeout": 2 }, "total_runs": 198 } }, "gpt-5.6-luna-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-luna", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 175922, "avg_output_tokens": 3035, "avg_total_tokens": 179562, "avg_wall_clock_seconds": 67.1, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-5.6-sol-codex-cli": { "micro": { "tp": 1289, "fp": 1202, "fn": 412, "tn": 0, "precision": 0.5175, "recall": 0.7578, "f2_score": 69.3, "f3_score": 72.4, "cvss_precision": 0.5281, "cvss_recall": 0.7646, "cvss_f3_score": 73.2 }, "strict_micro": { "tp": 1289, "fp": 1202, "fn": 412, "tn": 0, "precision": 0.5175, "recall": 0.7578, "f2_score": 69.3, "f3_score": 72.4, "cvss_precision": 0.5281, "cvss_recall": 0.7646, "cvss_f3_score": 73.2 }, "macro": { "f2_score": 68.3 }, "per_severity": { "high": { "tp": 1247, "fp": 0, "fn": 398 }, "low": { "tp": 7, "fp": 0, "fn": 4 }, "medium": { "tp": 32, "fp": 0, "fn": 9 }, "critical": { "tp": 3, "fp": 0, "fn": 1 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 21.8, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 313.6791, "successful_runs": 50, "cost_per_run": 6.2736, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0664 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-sol", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2539446, "avg_output_tokens": 26597, "avg_total_tokens": 2580604, "avg_wall_clock_seconds": 568.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-5.6-terra-codex-cli": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "gpt-5.6-terra", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 384521, "avg_output_tokens": 5219, "avg_total_tokens": 391543, "avg_wall_clock_seconds": 110.8, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "gpt-6-astra-codex-cli": { "micro": { "tp": 1020, "fp": 1583, "fn": 681, "tn": 0, "precision": 0.3919, "recall": 0.5996, "f2_score": 54.2, "f3_score": 56.9, "cvss_precision": 0.402, "cvss_recall": 0.613, "cvss_f3_score": 58.2 }, "strict_micro": { "tp": 1020, "fp": 1583, "fn": 681, "tn": 0, "precision": 0.3919, "recall": 0.5996, "f2_score": 54.2, "f3_score": 56.9, "cvss_precision": 0.402, "cvss_recall": 0.613, "cvss_f3_score": 58.2 }, "macro": { "f2_score": 53.3 }, "per_severity": { "high": { "tp": 991, "fp": 0, "fn": 654 }, "low": { "tp": 2, "fp": 0, "fn": 9 }, "medium": { "tp": 25, "fp": 0, "fn": 16 }, "critical": { "tp": 2, "fp": 0, "fn": 2 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 8.7, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 622.6276, "successful_runs": 50, "cost_per_run": 12.4526, "total_loc_scanned": 472583, "cost_per_100_loc": 0.1317 }, "metadata": { "has_metrics": true, "model": "gpt-6-astra", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 1854218, "avg_output_tokens": 13533, "avg_total_tokens": 1871335, "avg_wall_clock_seconds": 574.7, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "gpt-daybreak-blue-codex-cli": { "micro": { "tp": 1397, "fp": 1087, "fn": 304, "tn": 0, "precision": 0.5624, "recall": 0.8213, "f2_score": 75.2, "f3_score": 78.5, "cvss_precision": 0.5718, "cvss_recall": 0.8235, "cvss_f3_score": 78.9 }, "strict_micro": { "tp": 1397, "fp": 1087, "fn": 304, "tn": 0, "precision": 0.5624, "recall": 0.8213, "f2_score": 75.2, "f3_score": 78.5, "cvss_precision": 0.5718, "cvss_recall": 0.8235, "cvss_f3_score": 78.9 }, "macro": { "f2_score": 74.4 }, "per_severity": { "high": { "tp": 1352, "fp": 0, "fn": 293 }, "low": { "tp": 7, "fp": 0, "fn": 4 }, "medium": { "tp": 35, "fp": 0, "fn": 6 }, "critical": { "tp": 3, "fp": 0, "fn": 1 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 18.7, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 303.9072, "successful_runs": 50, "cost_per_run": 6.0781, "total_loc_scanned": 472583, "cost_per_100_loc": 0.0643 }, "metadata": { "has_metrics": true, "model": "gpt-daybreak-blue-latest", "prompt_version": "sha256:45a1200d61e6", "prompt_label": "tsjs-v1", "reasoning_effort": "high", "avg_input_tokens": 2616467, "avg_output_tokens": 24111, "avg_total_tokens": 2653601, "avg_wall_clock_seconds": 347.2, "json_repair_rate": 0.0, "exit_status_counts": { "success": 140 }, "total_runs": 140 } }, "kimi-k2.5-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.5", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 35305, "avg_output_tokens": 5278, "avg_total_tokens": 203853, "avg_wall_clock_seconds": 127.3, "json_repair_rate": 0.005, "exit_status_counts": { "success": 192, "validation_failed": 5, "timeout": 1 }, "total_runs": 198 } }, "kimi-k2.6-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.6", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 59331, "avg_output_tokens": 19631, "avg_total_tokens": 436133, "avg_wall_clock_seconds": 452.2, "json_repair_rate": 0.071, "exit_status_counts": { "success": 157, "validation_failed": 36, "timeout": 5 }, "total_runs": 198 } }, "kimi-k2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k2.7-code", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 60671, "avg_output_tokens": 17854, "avg_total_tokens": 508181, "avg_wall_clock_seconds": 311.3, "json_repair_rate": 0.045, "exit_status_counts": { "validation_failed": 11, "success": 187 }, "total_runs": 198 } }, "kimi-k3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "kimi-k3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 53273, "avg_output_tokens": 10894, "avg_total_tokens": 385393, "avg_wall_clock_seconds": 380.1, "json_repair_rate": 0.015, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-ca-cc-sonnet": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "claude-sonnet-4-6", "prompt_version": "kolega-claude-adaptation@agentic", "prompt_label": "Claude Code harness", "reasoning_effort": null, "avg_input_tokens": 169, "avg_output_tokens": 25487, "avg_total_tokens": 3597481, "avg_wall_clock_seconds": 396.6, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-r4", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-deepseek-only": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "twin-distill-flash-dsonly", "prompt_version": "", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 0, "avg_output_tokens": 0, "avg_total_tokens": 0, "avg_wall_clock_seconds": 0, "json_repair_rate": 0.0, "exit_status_counts": { "success": 66 }, "total_runs": 66 } }, "kolega-claude-adaptation-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-core-v0.0.1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-devsec-max-v0.1.0": { "micro": { "tp": 1580, "fp": 1959, "fn": 121, "tn": 0, "precision": 0.4465, "recall": 0.9289, "f2_score": 76.4, "f3_score": 83.8, "cvss_precision": 0.4057, "cvss_recall": 0.9304, "cvss_f3_score": 82.4 }, "strict_micro": { "tp": 1580, "fp": 1959, "fn": 121, "tn": 0, "precision": 0.4465, "recall": 0.9289, "f2_score": 76.4, "f3_score": 83.8, "cvss_precision": 0.4057, "cvss_recall": 0.9304, "cvss_f3_score": 82.4 }, "macro": { "f2_score": 75.6 }, "per_severity": { "high": { "tp": 1538, "fp": 0, "fn": 107 }, "low": { "tp": 1, "fp": 0, "fn": 10 }, "medium": { "tp": 39, "fp": 0, "fn": 2 }, "critical": { "tp": 2, "fp": 0, "fn": 2 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 7.4, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-original-claude-adaptation-deepseek-v4-pro": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "kolega-v0.0.2-raw": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "minimax-m2.7-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "MiniMax-M2.7", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 104466, "avg_output_tokens": 5546, "avg_total_tokens": 145833, "avg_wall_clock_seconds": 161.4, "json_repair_rate": 0.0, "exit_status_counts": { "success": 136, "validation_failed": 57, "timeout": 5 }, "total_runs": 198 } }, "ornith-q3-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "ornith-q3", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 307619, "avg_output_tokens": 7913, "avg_total_tokens": 315531, "avg_wall_clock_seconds": 243.0, "json_repair_rate": 0.455, "exit_status_counts": { "success": 58, "timeout": 2, "validation_failed": 6 }, "total_runs": 66 } }, "qwen3.6-35b-agentic-v1": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": true, "model": "qwen3.6-35b", "prompt_version": "sha256:3481f1432c23", "prompt_label": "", "reasoning_effort": null, "avg_input_tokens": 189528, "avg_output_tokens": 9021, "avg_total_tokens": 198550, "avg_wall_clock_seconds": 221.5, "json_repair_rate": 0.182, "exit_status_counts": { "success": 65, "validation_failed": 1 }, "total_runs": 66 } }, "rowan": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "semgrep": { "micro": { "tp": 190, "fp": 1277, "fn": 1511, "tn": 0, "precision": 0.1295, "recall": 0.1117, "f2_score": 11.5, "f3_score": 11.3, "cvss_precision": 0.1526, "cvss_recall": 0.1256, "cvss_f3_score": 12.8 }, "strict_micro": { "tp": 190, "fp": 1277, "fn": 1511, "tn": 0, "precision": 0.1295, "recall": 0.1117, "f2_score": 11.5, "f3_score": 11.3, "cvss_precision": 0.1526, "cvss_recall": 0.1256, "cvss_f3_score": 12.8 }, "macro": { "f2_score": 10.9 }, "per_severity": { "high": { "tp": 189, "fp": 0, "fn": 1456 }, "low": { "tp": 0, "fp": 0, "fn": 11 }, "medium": { "tp": 1, "fp": 0, "fn": 40 }, "critical": { "tp": 0, "fp": 0, "fn": 4 } }, "repos_scored": 50, "repos_total": 50, "f2_stddev": 5.5, "num_runs": 1, "language_coverage": { "tsjs": [ 50, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } }, "sonarqube": { "micro": { "tp": 0, "fp": 0, "fn": 0, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "strict_micro": { "tp": 0, "fp": 0, "fn": 1701, "tn": 0, "precision": 0.0, "recall": 0.0, "f2_score": 0.0, "f3_score": 0.0, "cvss_precision": 0.0, "cvss_recall": 0.0, "cvss_f3_score": 0.0 }, "macro": { "f2_score": 0.0 }, "per_severity": {}, "repos_scored": 0, "repos_total": 50, "f2_stddev": 0.0, "num_runs": 1, "language_coverage": { "tsjs": [ 0, 50 ] }, "cost": { "total_cost": 0.0, "successful_runs": 0, "cost_per_run": 0, "total_loc_scanned": 0, "cost_per_100_loc": 0 }, "metadata": { "has_metrics": false } } } }, "tab_repos": { "all": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvna", "realvuln-dvpwa", "realvuln-dvws-node", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-lets-be-bad-guys", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-api", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnerable-tornado-app", "realvuln-vulnnodeapp", "realvuln-vulnpy", "realvuln-vulpy", "realvuln-xvna", "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ], "python": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvpwa", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-lets-be-bad-guys", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vulnerable-api", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-tornado-app", "realvuln-vulnpy", "realvuln-vulpy", "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi" ], "tsjs": [ "realvuln-dvna", "realvuln-dvws-node", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnnodeapp", "realvuln-xvna", "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ], "intentional": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvna", "realvuln-dvpwa", "realvuln-dvws-node", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-lets-be-bad-guys", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-api", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnerable-tornado-app", "realvuln-vulnnodeapp", "realvuln-vulnpy", "realvuln-vulpy", "realvuln-xvna" ], "python:intentional": [ "realvuln-damn-vulnerable-flask-application", "realvuln-damn-vulnerable-graphql-application", "realvuln-djangoat", "realvuln-dsvpwa", "realvuln-dsvw", "realvuln-dvblab", "realvuln-dvpwa", "realvuln-extremely-vulnerable-flask-app", "realvuln-flask-xss", "realvuln-insecure-web", "realvuln-intentionally-vulnerable-python-application", "realvuln-lets-be-bad-guys", "realvuln-owasp-web-playground", "realvuln-pygoat", "realvuln-python-app", "realvuln-python-insecure-app", "realvuln-pythonssti", "realvuln-threatbyte", "realvuln-vampi", "realvuln-vfapi", "realvuln-vulnerable-api", "realvuln-vulnerable-flask-app", "realvuln-vulnerable-python-apps", "realvuln-vulnerable-tornado-app", "realvuln-vulnpy", "realvuln-vulpy" ], "tsjs:intentional": [ "realvuln-dvna", "realvuln-dvws-node", "realvuln-ivna", "realvuln-juice-shop", "realvuln-juice-shop-goof", "realvuln-nextjs-vulnerable-app", "realvuln-ninjasworkout", "realvuln-node-api-goat", "realvuln-nodegoat", "realvuln-nodejs-goof", "realvuln-oss-oopssec-store", "realvuln-react-security", "realvuln-react-test-bench", "realvuln-reactvulna", "realvuln-simply-vulnerable-react", "realvuln-vuln-node-express", "realvuln-vuln-node-express-swagger", "realvuln-vulnerable-app-angular", "realvuln-vulnerable-node", "realvuln-vulnerable-nodejs", "realvuln-vulnerable-react-fatih", "realvuln-vulnerable-rest-api-owasp-2023", "realvuln-vulnnodeapp", "realvuln-xvna" ], "vibe": [ "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ], "python:vibe": [ "vc-claude-code-seeded-v2-crm-saas-django", "vc-claude-code-seeded-v2-education-lms-django", "vc-claude-code-seeded-v2-fintech-lending-fastapi", "vc-claude-code-seeded-v2-healthcare-clinic-django", "vc-claude-code-seeded-v2-hr-payroll-django", "vc-claude-code-seeded-v2-legal-case-django", "vc-claude-code-seeded-v2-logistics-dispatch-fastapi", "vc-claude-code-seeded-v2-marketplace-commerce-fastapi", "vc-claude-code-seeded-v2-property-management-fastapi", "vc-claude-code-seeded-v2-support-desk-fastapi", "vc-codex-high-seeded-v2-crm-saas-django", "vc-codex-high-seeded-v2-education-lms-django", "vc-codex-high-seeded-v2-fintech-lending-fastapi", "vc-codex-high-seeded-v2-healthcare-clinic-django", "vc-codex-high-seeded-v2-hr-payroll-django", "vc-codex-high-seeded-v2-legal-case-django", "vc-codex-high-seeded-v2-logistics-dispatch-fastapi", "vc-codex-high-seeded-v2-marketplace-commerce-fastapi", "vc-codex-high-seeded-v2-property-management-fastapi", "vc-codex-high-seeded-v2-support-desk-fastapi", "vc-codex-seeded-v2-crm-saas-django", "vc-codex-seeded-v2-education-lms-django", "vc-codex-seeded-v2-fintech-lending-fastapi", "vc-codex-seeded-v2-healthcare-clinic-django", "vc-codex-seeded-v2-hr-payroll-django", "vc-codex-seeded-v2-legal-case-django", "vc-codex-seeded-v2-logistics-dispatch-fastapi", "vc-codex-seeded-v2-marketplace-commerce-fastapi", "vc-codex-seeded-v2-property-management-fastapi", "vc-codex-seeded-v2-support-desk-fastapi", "vc-kimi-code-seeded-v2-crm-saas-django", "vc-kimi-code-seeded-v2-education-lms-django", "vc-kimi-code-seeded-v2-fintech-lending-fastapi", "vc-kimi-code-seeded-v2-healthcare-clinic-django", "vc-kimi-code-seeded-v2-hr-payroll-django", "vc-kimi-code-seeded-v2-legal-case-django", "vc-kimi-code-seeded-v2-logistics-dispatch-fastapi", "vc-kimi-code-seeded-v2-marketplace-commerce-fastapi", "vc-kimi-code-seeded-v2-property-management-fastapi", "vc-kimi-code-seeded-v2-support-desk-fastapi" ], "tsjs:vibe": [ "vc-claude-code-seeded-v3-crm-saas-nestjs-angular", "vc-claude-code-seeded-v3-education-lms-nextjs", "vc-claude-code-seeded-v3-fintech-lending-express", "vc-claude-code-seeded-v3-healthcare-clinic-nextjs", "vc-claude-code-seeded-v3-hr-payroll-remix", "vc-claude-code-seeded-v3-legal-case-remix", "vc-claude-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-claude-code-seeded-v3-marketplace-commerce-express", "vc-claude-code-seeded-v3-property-management-fastify-vue", "vc-claude-code-seeded-v3-support-desk-nestjs-angular", "vc-codex-high-seeded-v3-crm-saas-nestjs-angular", "vc-codex-high-seeded-v3-education-lms-nextjs", "vc-codex-high-seeded-v3-fintech-lending-express", "vc-codex-high-seeded-v3-healthcare-clinic-nextjs", "vc-codex-high-seeded-v3-hr-payroll-remix", "vc-codex-high-seeded-v3-legal-case-remix", "vc-codex-high-seeded-v3-logistics-dispatch-fastify-vue", "vc-codex-high-seeded-v3-marketplace-commerce-express", "vc-codex-high-seeded-v3-property-management-fastify-vue", "vc-codex-high-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-flash-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-flash-seeded-v3-fintech-lending-express", "vc-deepseek-v4-flash-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-flash-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-flash-seeded-v3-legal-case-remix", "vc-deepseek-v4-flash-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-flash-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-flash-seeded-v3-support-desk-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-crm-saas-nestjs-angular", "vc-deepseek-v4-pro-seeded-v3-education-lms-nextjs", "vc-deepseek-v4-pro-seeded-v3-fintech-lending-express", "vc-deepseek-v4-pro-seeded-v3-healthcare-clinic-nextjs", "vc-deepseek-v4-pro-seeded-v3-hr-payroll-remix", "vc-deepseek-v4-pro-seeded-v3-legal-case-remix", "vc-deepseek-v4-pro-seeded-v3-logistics-dispatch-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-marketplace-commerce-express", "vc-deepseek-v4-pro-seeded-v3-property-management-fastify-vue", "vc-deepseek-v4-pro-seeded-v3-support-desk-nestjs-angular", "vc-kimi-code-seeded-v3-crm-saas-nestjs-angular", "vc-kimi-code-seeded-v3-education-lms-nextjs", "vc-kimi-code-seeded-v3-fintech-lending-express", "vc-kimi-code-seeded-v3-healthcare-clinic-nextjs", "vc-kimi-code-seeded-v3-hr-payroll-remix", "vc-kimi-code-seeded-v3-legal-case-remix", "vc-kimi-code-seeded-v3-logistics-dispatch-fastify-vue", "vc-kimi-code-seeded-v3-marketplace-commerce-express", "vc-kimi-code-seeded-v3-property-management-fastify-vue", "vc-kimi-code-seeded-v3-support-desk-nestjs-angular" ] }, "languages": { "python": "Python", "tsjs": "TypeScript / JS" } }